If this code is representative of all your code, then yes, I would suggest a complete rewrite, using more modern concepts (OOP, MVC, template engine, some framework, etc).

Until then, I would probably take the website offline, or at the very least add a web application firewall to the server. 

**Security**

Your code is currently vulnerable to SQL injection, XSS, and CSRF. 

You need to look into prepared statements to be secure against SQL injection. Some frameworks also provide ORMs or query builders, which may make it easier for you to securely access your database.

You then need to HTML encode user input when echoing it. Most templating engines also provide this functionality, and some encode per default (which I would recommend).

Most frameworks also offer some mechanism to protect against CSRF.

**Structure**

Your code is too long and not well structured, as you don't have any functions. 

Because of this, it also contains quite a bit of duplication (eg the edit/add forms which are quite similar, duplicated select queries, etc).

Most frameworks would make it easier to structure your code well, as they for example use MVC, or expect you to program things a certain way.

**Misc**

 - extract is a function that you mostly shouldn't use. It can have security implications, and it leads to less readable code. Just assign things to variables explicitly yourself.
 - You can use `'` and `"` for strings. You can use this to avoid having to escape `"` in all your forms.
 - you can use guard clauses to decrease the nesting of your code and make it more readable. Eg instead of `if (authenticate ("9", "0", "1") == "verified") {long block of code}` you would write `if (authenticate ("9", "0", "1") !== "verified") {return or die} long block of code`.