Shopping cart login and coupon code validation I am figuring out how I could make the following query more secure:
I have already used mysqli_real_escape_string but I doubt that adds much to security.

I have looked into the using prepared statements but I also have to take into account the following line:

$check_customer = mysqli_num_rows($run_c); 


My solution:

   $c_email = mysqli_real_escape_string($con,$_POST['email']);
        $c_pass = mysqli_real_escape_string($con,$_POST['pass']);
        $couponCodeLogin = mysqli_real_escape_string($con,$_POST['couponCodeLogin']);
$couponCodeLoginAmount = mysqli_real_escape_string($con,$_POST['couponCodeLoginAmount']);

        $sel_c = "select * from customers where customer_pass='$c_pass' AND customer_email='$c_email'";

        $run_c = mysqli_query($con, $sel_c);
        $check_customer = mysqli_num_rows($run_c); 
        if($check_customer==0){

        echo "&lt;script&gt;
        document.getElementById('loginError').innerHTML = 'Password or email is incorrect, please try again.'
        &lt;/script&gt;";
        exit();
        }


        if($check_customer&gt;0){
                    $crs_id = $_GET['crs_id'];

     $insert_c = "insert into customers (customer_email,coupon_code_login,coupon_code_login_amount) values ('$c_email','$couponCodeLogin','$couponCodeLoginAmount')";
                $run_c = mysqli_query($con, $insert_c); 


                $_SESSION['userCoupon'] = $_POST['couponCodeLoginAmount'];

        $_SESSION['customer_email']=$c_email; 
                        $_SESSION['userCouponName'] = $_POST['couponCodeLogin'];


        echo "&lt;script&gt;window.open('coursePayment.php?crs_id=$crs_id','_self')&lt;/script&gt;";

        }
        else {
        $_SESSION['customer_email']=$c_email; 


        echo "&lt;script&gt;window.open('coursePayment.php?crs_id=$crs_id','_self')&lt;/script&gt;";

        $_SESSION['userCoupon'] = $_POST['couponCodeLoginAmount'];
                $_SESSION['userCouponName'] = $_POST['couponCodeLogin'];

        }
    }


and

        $fname= mysqli_real_escape_string($con,$_POST['fname']);
        $lname = mysqli_real_escape_string($con,$_POST['lname']);
        $email = mysqli_real_escape_string($con,$_POST['email']);
        $pnumber = mysqli_real_escape_string($con,$_POST['pnumber']);       
 $couponCodeRegister=mysqli_real_escape_string($con,$_POST['couponCodeRegister']);
$couponCodeRegisterAmount = mysqli_real_escape_string($con,$_POST['couponCodeRegisterAmount']);

        $pass = mysqli_real_escape_string($con,$_POST['pass']);
        $cname = mysqli_real_escape_string($con,$_POST['cname']);
        $cposition = mysqli_real_escape_string($con,$_POST['cposition']);


         $insert_c = "insert into customers (customer_fname,customer_lname,customer_email,customer_number,customer_pass,customer_cname,customer_cposition,coupon_code_register,coupon_code_register_amount) values ('$fname','$lname','$email','$pnumber','$pass','$cname','$cposition','$couponCodeRegister','$couponCodeRegisterAmount')";

        $run_c = mysqli_query($con, $insert_c); 


        $insert_email = "select * from customers";
        $run_email = mysqli_query($con, $insert_email);

        $find_email = mysqli_fetch_array($run_email);
        $demail = $find_email['customer_email'];     

        if($email!= $demail)
       {
         $crs_id = $_GET['crs_id'];

         $_SESSION['userCoupon'] = $_POST['couponCodeRegisterAmount'];
         $_SESSION['userCouponName'] = $_POST['couponCodeRegister'];
         $_SESSION['customer_email']=$email; 

         echo "&lt;script&gt;
         document.getElementById('registerError').innerHTML = 'Account has been created successfully, Thanks!'
         &lt;/script&gt;";
         echo "&lt;script&gt;window.open('coursePayment.php?crs_id=$crs_id','_self')&lt;/script&gt;";

       }
You need to learn how to use prepared statements, aka queries. That way, user input is never part of the SQL command.

https://www.owasp.org/index.php/SQL_Injection_Prevention_Cheat_Sheet

http://prash.me/php-pdo-and-prepared-statements/