Two implementations of a PHP sign-up page I want the most secure and well-written version for my sign-up page. I'm adding AJAX to it for validation, too. I'm still writing it. 

If you have tips on AJAX or on how to improve this PHP code for AJAX, feel free to point out any mistake and make any modification you want, or if there are other security concerns I should worry about. I'm fairly new this is the most I know about how to fight SQL injection.

I wrote this version first after I learned about SQL injection:

if (isset($_POST['submit'])){
include_once 'dbh.inc.php';
  $username = mysqli_real_escape_string($conn, $_POST['username']);
  $pwd = mysqli_real_escape_string($conn, $_POST['pwd']);
  $email = mysqli_real_escape_string($conn, $_POST['email']);
if(empty($username) || empty($pwd) || empty($email)){
  echo "Fill in all Fields!";
}else {
   if(!filter_var($email, FILTER_VALIDATE_EMAIL)){
     echo "Email is invalid!";
   }else{
      $stmt = $conn-&gt;prepare("SELECT * FROM users WHERE username=?");
      $stmt-&gt;bind_param("s", $uid);
      $uid = $username;
      $stmt-&gt;execute();
      $result = $stmt-&gt;get_result();
      $usernamecheck = mysqli_num_rows($result);
      $rowNum = $result-&gt;num_rows;
    if($rowNum &gt; 0){
        echo "Username is taken!";
    }else{
        $stmt = $conn-&gt;prepare("SELECT * FROM users WHERE email=?");
        $stmt-&gt;bind_param("s", $uemail);
        $uemail = $email;
        $stmt-&gt;execute();
        $result = $stmt-&gt;get_result();
        $usernamecheck = mysqli_num_rows($result); 
        $rowNum = $result-&gt;num_rows;
    if($rowNum &gt; 0){
        echo "Email is taken";
    }else{
        $hashedPwd = password_hash($pwd, PASSWORD_DEFAULT);
        $stmt = $conn-&gt;prepare("INSERT INTO users (username, pwd, email) VALUES (?, ?, ?)");
    $stmt-&gt;bind_param("sss",$uid, $password, $theemail);
    $uid = $username;
    $password = $hashedPwd;
    $theemail= $email;
    $stmt-&gt;execute();
    $result = $stmt-&gt;get_result();
    header("location: ../user-login.php");
        }
        }
     }
    }
 }else{
header("location: ../user-signup.php");
exit();
}


and this version, which I was told is a better version, but has no prepared statements, which i learned is the main thing to fight SQL injection:

include_once '../dbh.inc.php';
if ($_SERVER['REQUEST_METHOD'] === 'POST') {
$username = $_POST['username'];
$email = $_POST['email'];
$pwd = $_POST['pwd'];
if(empty($username) || empty($pwd) || empty($email)){
  echo "Fill in all Fields!";
  exit();
}elseif(!filter_var($email, FILTER_VALIDATE_EMAIL)){
     echo "Email is invalid!";
     exit();
   }else{
$chk = "SELECT * FROM user WHERE email='$email'";
$result = mysqli_query($conn, $chk);
while ($row = mysqli_fetch_array($result)) {
  if ($row['email'] == $email) {
    echo "Email Match";
  exit();
  } else {
   $chk = "SELECT * FROM user WHERE username='$username'";
   $result = mysqli_query($conn, $chk);
   while ($row = mysqli_fetch_array($result)) {
    if ($row['username'] == $username) {
    echo "Username Match";
    exit();
  } else {
$hashedPwd = password_hash($pwd, PASSWORD_DEFAULT);
$join = sprintf("INSERT INTO user(username, email, password) " .
    "VALUES ('%s', '%s', '%s', '%s'); ",
  mysqli_real_escape_string($conn, $username),
  mysqli_real_escape_string($conn, $email),
  mysqli_real_escape_string($conn, $hashedPwd),
  mysqli_insert_id($conn));
  if (mysqli_query($conn, $join)) {
    $i = "joined";
  } else {
    $i = "failed to join";
  }
  echo $i;
  }
Escape the hashed password, don't hash the escaped password.... just hash the pw. 
Prefer prepared statements over escaping.
Break up the logic into functions. 
Please indent better - your formatting is a bit of a mess.
You do not need to use both escaping and prepared statements. Pick one. (Pick prepared statements)




Edit:

In this case, if your IDs are integers, you don't need to escape them or use prepared statements. Just check if they are integers first with is_numeric(). If you know they're integers then you know they're safe.

Generally though, prepared statements are the way to go.