Уязвимость в коде убрать

<?php
$link = mysql_connect("localhost", "dbname", "pass");
 
mysql_select_db("zipcodes", $link);
 
if(isset($_POST["data"])){
    $mycomment = explode("\r\n",$_POST['data'] );
    $lines = count($mycomment);
    for ($i = 0; $i <= 24; $i++) {
        if ($mycomment[$i] == NULL) {
            $mycomment[$i] = 0;
        }
    $mycomment[$i] = substr($mycomment[$i], 0, 6);
    }
}
 
if(!isset($_POST["data"])){
    for ($i = 0; $i <= 24; $i++) {
        $mycomment[$i] = 0;
    }
}
 
$SQL = "SELECT zipcode, city, type, class FROM list WHERE zipcode IN ('$mycomment[0]', '$mycomment[1]', '$mycomment[2]', '$mycomment[3]', '$mycomment[4]', '$mycomment[5]', '$mycomment[6]', '$mycomment[7]', '$mycomment[8]', '$mycomment[9]', '$mycomment[10]', '$mycomment[11]', '$mycomment[12]', '$mycomment[13]', '$mycomment[14]', '$mycomment[15]', '$mycomment[16]', '$mycomment[17]', '$mycomment[18]', '$mycomment[19]', '$mycomment[20]', '$mycomment[21]', '$mycomment[22]', '$mycomment[23]', '$mycomment[23]', '$mycomment[24]')";
$result = mysql_query($SQL) or die('Cannot Execute:'. mysql_error());
$num_rows = mysql_num_rows($result);
echo $num_rows;
if($num_rows > 0) {
    echo "<table class=\"center_table\">";
    while($row = mysql_fetch_array($result))
    {
        echo "<tr><td>$row[zipcode]</td><td>$row[city]</td><td>$row[type]</td><td>$row[class]</td></tr>";
    }
    echo "</table>";
}
?>