PHP Registration Form

<?php
    include ("../db_conn/db.php");

    //$msg = "";
    if(isset($_POST["submit"]))
    {
        $username = $_POST["username"];
        $email = $_POST["email"];
        $password = $_POST["password"];

        $username = mysqli_real_escape_string($db, $username);
        $email = mysqli_real_escape_string($db, $email);
        $password = mysqli_real_escape_string($db, $password);
        $password = md5($password);

        //$con = mysqli;
        //$sql="SELECT email FROM users WHERE email='$email'";
        //$result=mysqli_query($db, $sql);
        print($username . " " . $email . " ");
        $sql = "SELECT username, email FROM users WHERE username = ? OR email = ?";

        if($sql = mysqli_prepare($db,$sql)){
        mysqli_stmt_bind_param($sql, "ss", $user,$email);
        mysqli_stmt_execute($sql);
        $result = mysqli_stmt_get_result($sql);
        $result = bind_result($username, $email);
        if(mysqli_num_rows($result) !== 0){
        $row = mysqli_fetch_assoc($result);
        if($row['username']==$user){
            print('username exists <br />');
        }
        elseif($row['email']==$email){
            print('email exists <br />');
        }
        }
        else {
        print('username/email don\'t exist');
        }
        }
        else {
            if (mysqli_query($db,"INSERT INTO users (username, email, password)VALUES ('$username', '$email', '$password')") === TRUE){
                print("INSERTED '$username', '$email' and Password into table users");
            }else{
                print("Error INSERTING to table users");
            }
        }
    }
?>