Checking whether a user is on the donors list
The final parameter here is misnamed:

$conn = mysqli_connect(host, user, pass, table);


It denotes name of MySQL database (e.g. "test") rather than name of a table (e.g. "test.donors" or "donors.donors").

The _res suffix is superfluous and may be safely elided:

mysqli_stmt_bind_result($stmt, $username_res, $activated_res, $expiration_res);



  want to make sure it is secure against SQL injection.


Yes, you are using the API as recommended, in secure fashion.