Mysql DB intrusion

I have a fairly large DB connected to a website. I recently received many sql injections into my forms. Basically, I secured each variable with appropriate function to prevent my DB to be leaked. But, If an expert could look at my code and logs and confirm that this attack had no consequences.

There had been over 300 orders created on my website using this email, and exact address combinations.

email: sample@email.tst

In the Delivery Instructions part, the attacker put these codes (each time in a new order, (new DB entry).

0'XOR(if(now()=sysdate(),sleep(15),0))XOR'Z
if(now()=sysdate(),sleep(15),0)
-1" OR 2+299-299-1=0+0+0+1 -- 
-1' OR 2+781-781-1=0+0+0+1 or 'LOCT2b1D'='
-1' OR 2+315-315-1=0+0+0+1 -- 
-1 OR 2+698-698-1=0+0+0+1
ARzZfuRY'||DBMS_PIPE.RECEIVE_MESSAGE(CHR(98)||CHR(98)||CHR(98),15)||'
nKo3L3B2')) OR 116=(SELECT 116 FROM PG_SLEEP(15))--
LARu079R') OR 240=(SELECT 240 FROM PG_SLEEP(15))--
ezqagHqU' OR 922=(SELECT 922 FROM PG_SLEEP(15))--
OuG3kJ9x'; waitfor delay '0:0:15' -- 

Just to let you know, I only have 300 members in my DB, 273 rows exactly.

This is my PHP code, to prevent from most common code injections.

    if(!empty($_POST['firstname']) AND !empty($_POST['email']) AND !empty($_POST['address']) AND !empty($_POST['city']) AND !empty($_POST['state']) AND !empty($_POST['zip']) AND !empty($_POST['check'])){
        $firstname = htmlspecialchars($_POST['firstname']);
        $address = htmlspecialchars($_POST['address']);
        $email = htmlspecialchars($_POST['email']);
        $city = htmlspecialchars($_POST['city']);
        $state = htmlspecialchars($_POST['state']);
        $zip = htmlspecialchars($_POST['zip']);
        $phone = htmlspecialchars($_POST['phone']);
        $info = htmlspecialchars($_POST['info']);
        $link = htmlspecialchars($_SESSION['link']);
        $ref = htmlspecialchars($_SESSION['ref']);

        $firstnamelength = strlen($firstname);
        $addresslength = strlen($address);
        $emaillength = strlen($email);
        $citylength = strlen($city);
        $statelength = strlen($state);
        $ziplength = strlen($zip);
        $phonelength = strlen($phone);
        $infolength = strlen($info);
        $linklength = strlen($link);

        $_SESSION['email'] = $email;
        $_SESSION['firstname'] = $firstname;
        $_SESSION['city'] = $city;
        $_SESSION['address'] = $address;
        $_SESSION['state'] = $state;
        $_SESSION['zip'] = $zip;
        $_SESSION['phone'] = $phone;
        $_SESSION['info'] = $info;
        $_SESSION['ref'] = $ref;

 if(filter_var($email, FILTER_VALIDATE_EMAIL)){
    if($linklength <= 400) {
       $insert = $bdd->prepare("INSERT INTO id(link, email, name, address, additional, postcode, city, country, phone, ref, ip) VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)");
       $insert->execute(array($link, $email, $firstname, $address, $info, $zip, $city, $state, $phone, $ref, $ipsafe));
       $error = "All Green";


                                            header("Location: ty2.php");
                                        }
                                    }

Oh, Btw, there is a whole section of conditions to prevent infinite variables to get in, each secure variable is valid if($firstnamelength <= 100) etc.

Finally, since the attack, I already put a reCaptcha into my forms.

I would appreciate to receive feedback on my code. Do you think he managed to get into my DB ?

Thank you for your time.