How to defend yourself against such a hacker attack?

A special order was placed today (in attachment)
I collect orders from several stores through an external application; I don't use the Litecart admin panel.
The guy used fields on the checkout page and the comment field to upload code to the store server.
Theoretically, opening this order in Litecart would have triggered an attack.

Using Gemini, I deleted the order through PHPadmin and implemented protection against such an attack in the future.
I'm not a programmer, so I'm asking.
Is this enough to protect against future attacks?
(I add code to .htaccess)

# Security Headers
<IfModule mod_headers.c>
  Header always set Content-Security-Policy "default-src 'self' 'unsafe-inline' 'unsafe-eval'; script-src 'self' 'unsafe-inline' 'unsafe-eval'; connect-src 'self'; img-src 'self' data: https:; frame-src 'none'"
  Header always set X-XSS-Protection "1; mode=block"
  Header always set X-Content-Type-Options "nosniff"
</IfModule>

Can this be done better?

You know, this is just the code proposed by LLM.

What you are looking at is a XSS injection. You need to make sure user input is sanitized before sticking it in the database. And when output on the page, LiteCart does this by default.

So this attack won't work on Litecart stores? There's no need to worry, and I don't need to enter the code proposed by Gemini into my hraccess?

There are no known vulnerabilities open in LiteCart where an XSS attack is succcessfully carried out.
That said, it doesn't hurt tripling your protection. Content-Security-Policy can add some obstacles for an attacker, but more commonly create new problems for a site owner. Add it if you have the time to fiddle with it. Do it in a dev environment as it might unlock some headache for you.

Thank You Tim