อยากทราบวิธีป้องกัน Code PHP ไม่ให้คนเข้าไปแก้ไข หรือป้องกัน SQL injection

    <?
	  
	 $query = "SELECT * FROM history_topup ORDER by balance DESC LIMIT 5";
	 $result = mysqli_query($con,$query);
		 while ($row = mysqli_fetch_array($result)) {
			 $player = $row['player'];
			 $balance = $row['balance'];
			 echo "<tr><td><img src='https://minotar.net/avatar/$player' width='32' height='32'></td><td>$player</td><td><center>$balance</center></td></tr>";
		 }
	 
	 ?>

$con = new mysqli($servername,$server_user,$server_password,$mysql_dbname);
$nick = $_POST['nick'];
$amount = PriceAmount();
if(Refill($_POST['tm_card'])==1){//ส่งเลขบัตรทรูวอเลตถ้าถูกต้องจะส่งค่ากลับมาเปนเลข 1
echo '<script> swal("เติมเงินสำเร็จ", "ชื่อผู้ใช้ : '.$nick.'<br>รหัสบัตรทรู : '.$_POST['tm_card'].'<br>จำนวนเงิน : '.$amount.'", "success");</script>';
$sql_addpoint = "UPDATE coins_data SET 
                    balance=?
					WHERE nick=?";
$stmt_addpoint = $con->prepare($sql_addpoint);
$stmt_addpoint->bind_param('ds',$amount,$nick);
$stmt_addpoint->execute();
$stmt_addpoint->close();
$sql_check_addhistory_topup = "SELECT * FROM history_topup WHERE player=?";
$stmt_check_addhistory_topup = $con->prepare($sql_check_addhistory_topup);
$stmt_check_addhistory_topup->bind_param('s',$nick);
$stmt_check_addhistory_topup->execute();
	if (($numrows = $stmt_check_addhistory_topup->num_rows) > 0) {
			$sql_addtopup = "UPDATE history_topup SET
									balance=?
									WHERE player=?";
			$stmt_addtopup = $con->prepare($sql_addtopup);
			$stmt_addtopup->bind_param('ds',$amount,$nick);
			$stmt_addtopup->execute();
			$stmt_addtopup->close();
		} else {
			$sql_addhistory_topup = "INSERT INTO history_topup (player, balance) VALUES (?, ?)";
			$stmt_addhistory_topup = $con->prepare($sql_addhistory_topup);
            $stmt_addhistory_topup->bind_param('sd',$nick,$amount);
            $stmt_addhistory_topup->execute();
            $stmt_addhistory_topup->close();			
}
  $stmt_check_addhistory_topup->close();
  $con->close();
} else {
 echo '<script> swal("เติมเงินไม่สำเร็จ", "คุณ '.$nick.' รหัสบัตรทรู '.$_POST['tm_card'].' ไม่ถูกต้อง", "error");</script>';
 $sql_addtruemoneytopup = "INSERT INTO truemoney_topup (tm_card,nick,balance) VALUES (?, ?, ?)";
 $stmt_addtruemoneytopup = $con->prepare($sql_addtruemoneytopup);
 $stmt_addtruemoneytopup->bind_param('dsd',$_POST['tm_card'],$nick,$amount);
 $stmt_addtruemoneytopup->execute();
 $stmt_addtruemoneytopup->close();
 $con->close();
}

<?php

debug_backtrace() || die ("<h2>Access Denied!</h2> This file is protected and not available to public.<br><a href='/mc-just/index.php'>Enter to HomePage</a>");

//Title เว็บ Site
$Cfg["web"]["title"] = "MC-JUST"; 

//Token URL
$download_page = isset($_GET['download_page']) ? $_GET['download_page'] : '';

//news
$news['1'] = "เซิฟเวอร์ได้เปิดแล้ว";
$news['2'] = "รอการอัพเดต....";
$news['3'] = "รอการอัพเดต....";
$news['4'] = "รอการอัพเดต....";
$news['5'] = "รอการอัพเดต....";

//Databate
$servername = 'localhost';
$server_user = 'root';
$server_password = 'XXX';
$mysql_dbname = 'minecraft';
$mysql_table = "coins_data";
$mysql_field_username = "nick";
$mysql_point_field_name = "balance";

//TrueWallet
$tw_email = "[email protected]";
$tw_pass = "XXX";


?>