งานที่เขียนด้วยphpสดๆ ตัวเช็ค login โดนแฮกบ่อยมากครับ ทำให้ไปลบตารางผู้ใช้ แนะนำหน่อยครับ

<?php session_start();
if (!isset($_POST['txt_user'], $_POST['txt_pass'])) {
    header('Location: ../kick.php?error=1'); // ไม่มีpost
    exit;
} 


// Recap
$Code = 0 ;
$Code=strlen($_POST["txt_user"]); // ฟังก์ชันในการนับจำนวนตัวอักษร 
if($Code=="" or strlen($Code != 13))
{   	
    header('Location: ../kick.php?error=13'); //อักษรไม่ครบ
    exit;

}
Else 
{       }

//End Recap



// recap

$response = $_POST["g-recaptcha-response"];

  $privatekey = "6LfiJDUUAAAAABa3DgXjv74LdtiMhsS7oIRp4W-F"; // Private Key


$url = 'https://www.google.com/recaptcha/api/siteverify';
	$data = array(
		'secret' => '6LfiJDUUAAAAABa3DgXjv74LdtiMhsS7oIRp4W-F',
		'response' => $_POST["g-recaptcha-response"]
	);
	$options = array(
		'http' => array (
			'method' => 'POST',
			'content' => http_build_query($data)
		)
	);
	$context  = stream_context_create($options);
	@$verify = file_get_contents($url, false, $context);
	$captcha_success=json_decode($verify);
	if ($captcha_success->success==false) {
		
		//echo "<p>You are a bot! Go away!</p>";

	  echo "<script type='text/javascript'>alert('รหัสลับไม่ถูกต้องกรุณากรอกใหม่')</script>";
echo '<script language=Javascript>top.location.href="../login.php";</script>';
	  
	echo "<font color='red'>Captcha Invalid code</font>";
  }

 else if ($captcha_success->success==true) 

{ 
 // end recap		
	




// login
//include 'conn.php';

include'../conn.php';  
include'../config.php';

$user = stripslashes($_POST["txt_user"]);
	$pass = stripslashes($_POST["txt_pass"]);
	
	
	  
	$user2 = htmlentities($user, ENT_QUOTES, 'UTF-8');
	$pass2 = htmlentities($pass, ENT_QUOTES, 'UTF-8');
      
    
    // แปลง Pass เป็น fomatในฐานข้อมูล
			
	$datetoday = $pass2; //060435
	$y = substr( $datetoday, 4, 2 ); //2016
	$m = substr( $datetoday, 2, 2 ); //09
	$d = substr( $datetoday, 0, 2 ); //28
	$pass2 = (($y+2500)-543).'-'.$m.'-'.$d ;
	 // echo $pass2;
	  
    // นศ หรือ บุคคลากร
    




/// TEACHER
if($_POST['type']=='TECH') //เป็นครู
	  {   
		  

// เริ่มครู

$stmt = mysqli_prepare($mysqli, 'SELECT * FROM `teacher` WHERE `teach_id` = ?');
mysqli_stmt_bind_param($stmt, 's', $_POST['txt_user']);
mysqli_stmt_execute($stmt);
$result = mysqli_stmt_get_result($stmt);
$user = mysqli_fetch_assoc($result);

if (!$user) {
    header('Location: ../login.php?error=4'); //User ผิด
    exit;
}

/// แปลง pass
$datetoday = $_POST['txt_pass']; //060435
$y = substr( $datetoday, 4, 2 ); //2016
$m = substr( $datetoday, 2, 2 ); //09
$d = substr( $datetoday, 0, 2 ); //28
$_POST['txt_pass'] = (($y+2500)-543).'-'.$m.'-'.$d ;

if (!password_verify($_POST['txt_pass'], $user['bd_verify'])) {

    header('Location: ../kick.php?error=5'); //pass ผิด
    exit;
}
	 // SESSION อาจารย์
		
     $_SESSION["user_id"] = $user["teach_id"];
     $_SESSION["user_name"] = $user["teach_name"];
     $_SESSION["user_status"] = $user["teach_status"];
     $_SESSION["user_level"] = $user["teach_level"];
     $_SESSION["area_id"] = $user["area_id"];
     $_SESSION["fac_id"] = $user["teach_depart"];
     $_SESSION["user_img"] = 'teacher/'.$user["teach_img"];
     

         session_write_close(); //ปิดการเขียนเซสชั่น
     

         
switch ($user['teach_status']) {
    case '1':

//save Log type2
$sql_log = "INSERT INTO log (type,user) 
VALUES ('2','".$_SESSION["user_id"]."')";

$query_log  = mysqli_query($conn,$sql_log );

if($query_log ) {


		/// Line Noti
        function send_line_notify($message, $token)
        { $ch = curl_init(); curl_setopt( $ch, CURLOPT_URL, "https://notify-api.line.me/api/notify"); curl_setopt( $ch, CURLOPT_SSL_VERIFYHOST, 0); curl_setopt( $ch, CURLOPT_SSL_VERIFYPEER, 0); curl_setopt( $ch, CURLOPT_POST, 1); curl_setopt( $ch, CURLOPT_POSTFIELDS, "message=$message"); curl_setopt( $ch, CURLOPT_FOLLOWLOCATION, 1); $headers = array( "Content-type: application/x-www-form-urlencoded", "Authorization: Bearer $token", ); curl_setopt($ch, CURLOPT_HTTPHEADER, $headers); curl_setopt( $ch, CURLOPT_RETURNTRANSFER, 1); $result = curl_exec( $ch ); curl_close( $ch ); return $result;
        }
        $message = $_SESSION["user_name"].' (TECH) เข้าสู่ระบบ';
        $token = '4QPWXGg4VsCCZQJhkkMiFCXEQV4LTHsUfx23cln2g6v';
        //echo '<div  style="color: white;">';
         send_line_notify($message, $token);
       // echo '</div>';
        /// cloes Line Noti	

    }     

        header('Location: ../index.php');
        exit;
    case '0':
        header('Location: ../kick.php?error=0');
        exit;
    case '3': 
        header('Location: ../kick.php?error=4');
        exit;
    default:
        header('Location: ../kick.php?error=6');
        exit;
}


} /// จบครู  ไปต่อ elseif นศ