PHP - Warning: mysqli_real_escape_string()

<?php

$host = "localhost";         //server mysql default pada cpanel : localhost

$username = "root"; //user database mysql

$password = "";  //password database mysql

$dbname = "tc"; //nama database mysql

$conn = new mysqli($host, $username, $password, $dbname);

if ($conn->connect_error){

    die("Connection failed: " . $conn->connect_error);

}

mysqli_query($conn,"SET CHARACTER SET 'utf8'");

$sql = ("CREATE TABLE IF NOT EXISTS api ( `api` varchar(32) NOT NULL, `author` varchar(32) NOT NULL, `status` varchar(32) NOT NULL, `date` varchar(255), PRIMARY KEY (`api`) ) ENGINE=MyISAM DEFAULT CHARSET=utf8");

$sql = ("CREATE TABLE IF NOT EXISTS invitecode ( `Num` varchar(32) NOT NULL, `Author` varchar(32) NOT NULL, `Registered` varchar(32) NOT NULL, `Date` varchar(255), `Regby` varchar(255) NOT NULL, PRIMARY KEY (`Num`) ) ENGINE=MyISAM DEFAULT CHARSET=utf8");

$sql = ("CREATE TABLE IF NOT EXISTS invitecodepaid ( `Num` varchar(32) NOT NULL, `Author` varchar(32) NOT NULL, `Registered` varchar(32) NOT NULL, `Date` varchar(255), `Regby` varchar(255) NOT NULL, PRIMARY KEY (`Num`) ) ENGINE=MyISAM DEFAULT CHARSET=utf8");

$sql = ("CREATE TABLE IF NOT EXISTS invitecodeforpaid ( `Num` varchar(32) NOT NULL, `Author` varchar(32) NOT NULL, `Registered` varchar(32) NOT NULL, `Date` varchar(255), `Regby` varchar(255) NOT NULL, PRIMARY KEY (`Num`) ) ENGINE=MyISAM DEFAULT CHARSET=utf8");

$sql = ("CREATE TABLE IF NOT EXISTS giftcode ( `num` varchar(32) NOT NULL, `author` varchar(32) NOT NULL, `amount` varchar(32) NOT NULL, `registered` varchar(32) NOT NULL, `date` varchar(255), `regby` varchar(255) NOT NULL, PRIMARY KEY (`num`) ) ENGINE=MyISAM DEFAULT CHARSET=utf8");

$sql = ("CREATE TABLE IF NOT EXISTS orders ( `id` varchar(32) NOT NULL, `email` varchar(32) NOT NULL, `amount` varchar(32) NOT NULL, `credit` varchar(32) NOT NULL,  `payment` varchar(255) NOT NULL, `date` varchar(255), PRIMARY KEY (`id`) ) ENGINE=MyISAM DEFAULT CHARSET=utf8");

$sql = ("CREATE TABLE IF NOT EXISTS user (`email` varchar(32) NOT NULL, `password` varchar(255) NOT NULL, `credits` varchar(255) NOT NULL, `banned` varchar(255) NOT NULL, `admin` varchar(255) NOT NULL,`orders` varchar(255) NOT NULL, `regby` varchar(32) NOT NULL, `invitecode` varchar(255) NOT NULL, PRIMARY KEY (`email`) ) ENGINE=MyISAM DEFAULT CHARSET=utf8");

$sql = ("CREATE TABLE IF NOT EXISTS news( `id` int(5) NOT NULL auto_increment,`message` varchar(300) NOT NULL, `date` varchar(300) NOT NULL, PRIMARY KEY (`id`)  ) ENGINE=MyISAM DEFAULT CHARSET=utf8");

if ($conn->query($sql) === TRUE) {

    echo "Tabla creada correctamente";

} else {

    echo "Error al crear tabla : " .$conn->error;

}

$conn->close()

?>

<?php

require_once("auth.php");

$username = $_POST['email'];

$password = $_POST['password'];

$username = mysqli_real_escape_string($conn, $_POST['username']);

$ic = str_replace("'","",$_POST['invite_code']);

$query = ("SELECT * FROM user WHERE email = '$username'");

if(mysqli_num_rows($cekuser) == 1) {

header('location:../?bad=1');

} else {

if(!$username || !$password) {

header('location:/?bad=2');

} else {

$simpan = 1;

if($simpan) {

header('location: /en_reg.php?email='.$username.'&password='.$password.'&invite_code='.$ic);

} else {

header('location: /?bad=3');

}

}

}

?>