I do not understand why you put the WHERE condition in your context.
In your latest query, you are basically asking if the $zip is not equal to OR equal to the records of your table.
That would mean every record. Even if that person inputs anything dumb, all records from your table zip_code will still be returned.
To verify the integrity of user inputs, you can, at minimum, verify the length of the zip code(5, if in US). If you want to go deeper in the validation process, you can use regex.
$sql = "SELECT * FROM zip_code";
$sql = "SELECT zip_code, lattitude, longitude FROM zip_code"; // OR, if your function takes in the parameters in this sequence..
That is sufficient.
Based on your problem, that is what you probably want to do anyway. Since you are determining if the user input zip code is within the range radius only per record fetching.