Payment Information not secured

[Fxdpt]

It seems the payments informations are not secured when writted in database:

$paymode=$_POST['paymod'];
$bankname=$_POST['bank'];
$cardname=$_POST['cardname'];
$cardno=$_POST['cno'];
$cvv=$_POST['cvv'];
$expiry=$_POST['expdate'];
$sql_users = "INSERT INTO payment(paymode,bankname,cardname,cardno,cvv,expiry) VALUES ('$paymode','$bankname','$cardname','$cardno','$cvv','$expiry')";

you pass all the POST input in raw in your sql query. That means :
1- I can easily do an SQL Injection in your code
2- According to 1 I can get all the creditcard number & related informations of your user.

What you can easily do to correct this is: using prepare() execute() if you using PDO, or, create a little function

function clearInput(string $value) : string
{
    trim($value);
    htmlspecialchars($value);
    
    return $value;
}

then:

$cardname= clearInput($_POST['cardname']);
$cardno= clearInput($_POST['cno']);
$cvv= clearInput($_POST['cvv']);
$expiry=clearIntpu($_POST['expdate']);

Then you should check if the payment information don't exist before writing them in db, also that means you can add x times the same credit card in database at each user payment.