I have the following code in my php file: 

```
        session_start();
        include "connect.php";
        if (isset($_POST['email']) && isset($_POST['password'])) {
            $email = htmlspecialchars(mysqli_real_escape_string($conn, $_POST['email']));
            $password = htmlspecialchars(mysqli_real_escape_string($conn, $_POST['password'])); 

        function process() {

            include "connect.php";
            if  (isset($_POST['email']) && isset($_POST['password'])) {
                $email = $_POST["email"];
                $password = $_POST["password"];
            }

            mysqli_select_db($conn, "users");
            $sql = "SELECT * FROM users WHERE email='$email' AND password='$password'";
            $result = mysqli_query($conn, $sql);
            $count = mysqli_num_rows($result);

            if ($count >= 1) { 
            $_SESSION['id'] = $id;
            $_SESSION['email'] = $email;
            $_SESSION['password'] = $password;
            header('location:index.php');
    } else {
        echo "Email/Password is incorrect";
    }
}
        if ($email != "" or $password != "") {
            if (isset($_POST['submit'])) {
                process();
            } else {
                echo "Error: " . mysql_error();
            }

}
}

```

How would I go about preventing sql injection in my login page?
I searched on the internet and most sites said I must use the mysqli\_real\_escape\_string() function, but this did not seem to change things at all when I used the sql injection in my site again.
please help :)