OOP - Registrácia ochrana proti SQL injection

<?php
include 'db_config.php';

class User {
    public $db;
    
    public function __construct() {
        $this->db = new mysqli(DB_SERVER, DB_USER, DB_PASS, DB_DATABASE);
        if(mysqli_connect_errno()) {
            echo 'Error: Could not connect to database.';
            exit;
        }
    }

    public function userReg() {
        $uname = $_POST['uname'];
        $upass = hash('SHA512', $_POST['upass']);
        $upass2 = hash('SHA512', $_POST['upass2']);
        $uemail = $_POST['uemail'];
        $error = '';
        
        if(empty($uname) OR empty($upass) OR empty($uemail)) {
            $error = 'Vyplnte vsetky polia';
        }
        elseif(strlen($uname) <= 5) {
            $error = 'Meno je kratke';
        }
        elseif(strlen($upass) <= 10) {
            $error = 'Heslo musi obsahovat viac než 10 znakov';
        }
        elseif($upass != $upass2) {
            $error = 'Hesla sa nezhoduju';
        }
        if(empty($error)) {
            $sql = "SELECT * FROM users WHERE username='$uname' OR email='$uemail'";
            
            $check =  $this->db->query($sql);
            $count_row = $check->num_rows;
            
            
            if($count_row >= 1) {
                echo 'Uživateľ už existuje!';
                return false;
            }
            else {
                $sql1 = "INSERT INTO users SET username='" . mysqli_real_escape_string($this->db->$uname) . "', password='$upass', email='$uemail'";
                $result = mysqli_query($this->db, $sql1) or die(mysqli_connect_error()."Chyba zápisu dát do DB!");
                echo 'úspešne zaregistrovaný';
                return $result;
            }    
        }
        else {echo $error;}
    }
}

    public function userReg() {
        $uname = $this->db->real_escape_string($_POST['uname']);
        $upass = hash('SHA512', $_POST['upass']);
        $upass2 = hash('SHA512', $_POST['upass2']);
        $uemail = $_POST['uemail'];
        $error = '';

$uname = $this->db->real_escape_string($_POST['uname']);