The following code simply declares a string variable that contains the MySQL query:
$sql = "INSERT INTO users (username, password, email) VALUES ('".$_POST["username"]."','".$_POST["password"]."','".$_POST["email"]."')";
This does not fulfill the request. You need to use some functions for this, but let me explain something else first.
NEVER TRUST THE USER'S LOGIN . Never add user input (e.g. form input from $_GET or $_POST ) directly to your request. Someone can neatly manipulate input so that it can do a lot of damage to your database. This is called SQL injection. You can read more about it here.
To protect your script from such an attack, you must use prepared statements. Read more about ready-made statements here.
Include prepared statements in your code as follows:
$sql = "INSERT INTO users (username, password, email) VALUES (?,?,?)";
Pay attention to how ? used as placeholders for values. Then you must prepare the expression using mysqli_prepare :
$stmt = mysqli_prepare($sql);
Then start associating the input variables with the prepared statement:
$stmt->bind_param("sss", $_POST['username'], $_POST['email'], $_POST['password']);
And finally, execute prepared statements. (The actual insertion takes place here)
$stmt->execute();
NOTE Although this is not part of the question, I strongly advise you to never store passwords in clear text. Instead, you should use password_hash to store the password hash