สอบถาม การเขียน Code ยังงี้มีความปลอดภัยไหมครับสามารถดักแก้ไขข้อมูลระหว่างทางไหมครับ

<form action="" method="post" name="mudasenha" id="mudasenha">
<table width="100%" border="0" align="center" cellpadding="20"
    cellspacing="0" rules="none">
    <tr>
        <td width="28%" align="right"><font color="#FFFFFF">Code GC : </font></td>
  <td colspan="3" align="left">
  <input name="codigo" type="varchar" class="input-block-level" placeholder="Code GC Warz-RunZ"id="atual2" size="20" maxlength="30">
<input name="ip" type="Hidden"  value="<?php echo ''.$_SERVER["REMOTE_ADDR"].'';?>" id="ip"  class="input-xlarge">
  </td>
  </tr>
    <tr>
        <td height="138">&nbsp;</td>
        <td width="20%">&nbsp;</td><p>
        <td width="43%" align="left" valign="bottom"><input name="Submit" type="submit" class="btn btn-large btn-warning" value="ยืนยัน" /></td>
        <td width="9%">&nbsp;</td>
    </tr>
    <tr><td>&nbsp;</td>
      </tr>
    <tr>
      <td>&nbsp;</td>
    </tr>
</table>
</form>
<?php
                }
                else
                {
					$email = stripslashes($_POST['email']);
					$ip = stripslashes($_POST['ip']);
                    $codigoID = stripslashes($_POST['codigo']);
					$ip = htmlspecialchars($ip,ENT_QUOTES);
                    $codigo = htmlspecialchars($codigoID,ENT_QUOTES);
					$email = htmlspecialchars($email ,ENT_QUOTES);
					  
                    $sql_code_check = "SELECT Used FROM CodeBonus WHERE gcCode='$codigo'";
                    $count = sqlsrv_query( $db, $sql_code_check);
                    if($count === false) {
                         die( print_r( sqlsrv_errors(), true));
                    }
                    $code_check = count(sqlsrv_fetch_array( $count, SQLSRV_FETCH_ASSOC));
					
                    $sql_code_check1 = "SELECT Used FROM CodeBonus WHERE gcCode='$codigo'";
                    $sql_code_check1 = sqlsrv_query( $db, $sql_code_check1);
                    if( $sql_code_check1 === false ) {
                         die( print_r( sqlsrv_errors(), true));
                    }
                    if( sqlsrv_fetch( $sql_code_check1 ) === false) {
                         die( print_r( sqlsrv_errors(), true));
                    }
                    $code_check1  = sqlsrv_get_field( $sql_code_check1, 0);
					
                    $sql_code_qtd = "SELECT Quantity FROM CodeBonus WHERE gcCode='$codigo'";
                    $sql_code_qtd = sqlsrv_query( $db, $sql_code_qtd);
                    if( $sql_code_qtd === false ) {
                         die( print_r( sqlsrv_errors(), true));
                    }
                    if( sqlsrv_fetch( $sql_code_qtd ) === false) {
                         die( print_r( sqlsrv_errors(), true));
                    }
                    $code_qtd  = sqlsrv_get_field( $sql_code_qtd, 0);
					
                    
					
                    if (empty($codigo))
                    {
                        ?>
                        <script>
                            window.alert("กรุณากรอกโค๊ดก่อนครับ!");
                            window.location='?warz=code';
                        </script>
                        <?PHP
                    }
                    elseif ($code_check == 0)
                    {
                        ?>
                        <script>
                            window.alert("โค๊ดไม่ถูกต้อง!");
                            window.location='?warz=code';
                        </script>
                        <?php
                    }
                    elseif ($code_check1 != 0)
                    {
                        ?>
                        <script>
                            window.alert("โค๊ดนี้ถูกใช้งานแล้ว!");
                            window.location='?warz=code';
                        </script>
                        <?php
                    }
                    else
                    {
                        $sql = sqlsrv_query($db,"UPDATE UsersData SET GamePoints += '$code_qtd' WHERE CustomerID = '$customer'");
                        $sql = sqlsrv_query($db,"UPDATE CodeBonus SET CustomerID = '$customer' WHERE gcCode = '$codigo'");
						$sql = sqlsrv_query($db,"UPDATE CodeBonus SET CustomerID = '$customer' WHERE gcCode = '$codigo'");
                        $sql = sqlsrv_query($db,"UPDATE CodeBonus SET Used = '1' WHERE gcCode = '$codigo'");
						$sql = sqlsrv_query($db,"INSERT CodeBonus SET ip= '$ip' WHERE gcCode = '$codigo'");
                        ?>
                        <script>
                            window.alert("คุณได้รับ <?php echo $code_qtd; ?> GC");
                            window.location='index.php';
                        </script>
                        <?PHP
                    }
                }
                ?>