PHP code for search page
Being as big an advocate of prepared statements as I am, I cannot find any way for the SQL injection here, so your code should be safe.

I could only do the usual routine of making this code less bloated: 

$query = "SELECT * FROM `table` WHERE `status` = '0' ";

if(!empty($_POST['codes'])) {
    preg_match_all("/\d{6}/", $_POST['codes'], $codes_array);
    $codes_array = array_unique($codes_array[0]);
    $codes_list = implode(",", $codes_array);
    $codes_add = $codes_list ? " AND `code` IN ($codes_list)" : "";
    $query .= $codes_add;
}
$result = mysqli_query($link, $query);


basically, PHP already has a function to glue array values together called implode() and, based on my understanding of the SQL, I decided to change REGEXP for IN. If I am wrong, then you could simply change it back to regexp.