Registration System PHP, mysqli ( Hashing )

Question

Below is a simple registration script using php, I obviously want to store peoples data securely. I was wondering where would be the best place to implement the hashing script? Would it be implemented in the script below or have it alone?

<?php
    //values to be inserted in database table
    //session_start();
    include('connect.php');
    $email = $_POST['email'];
    $password= $_POST['password'];
    $username= $_POST['username'];

    $query = "INSERT INTO users (username, email, password) VALUES(?, ?, ?)";
    $statement = $mysqli->prepare($query);

    //bind parameters for markers, where (s = string, i = integer, d = double,  b = blob)
    $statement->bind_param('sss', $username, $email, $password);

    if($statement->execute()){
         print 'Success! ID of last inserted record is : ' .$statement->insert_id .'<br />'; 
    }else{
         die('Error : ('. $mysqli->errno .') '. $mysqli->error);
    }
    $statement->close();
    ?>

Another thing, when fetching peoples information from the database so they can sign in do I fetch their hashed password or do I have to recreate a hashed version of the password they've entered? I've read different ways of doing it, I just want to know the most secure. Thank you

EDIT:

This is my login code

<?php
include 'connect.php';
if ( !isset($_POST['username'], $_POST['password']) ) {
    // Could not get the data that should have been sent.
    die ('Username and/or password does not exist!');
}
// Prepare our SQL 
if ($stmt = $mysqli->prepare('SELECT password FROM users WHERE username = ?')) {
    // Bind parameters (s = string, i = int, b = blob, etc), hash the password using the PHP password_hash function.
    $stmt->bind_param('s', $_POST['username']);
    $stmt->execute(); 
    $stmt->store_result(); 
    // Store the result so we can check if the account exists in the database.
    if ($stmt->num_rows > 0) {
        $stmt->bind_result($password);
        $stmt->fetch();      
        // Account exists, now we verify the password.
        if (password_verify($_POST['password'], $password)) {
            // Verification success! User has loggedin!
                        echo 'You have logged in!';
        } else {
            echo 'Incorrect username and/or password!';
        }
    } else {
        echo 'Incorrect username blar password!';
    }
    $stmt->close();
} else {
    echo 'Could not prepare statement!';
}
?>

ANSWER:

<?php
//values to be inserted in database table
//session_start();
include('connect.php');

//Fixed cost of 10 to fit server req
//Random salt to be added to the pass
$options = [
    'cost' => 10,
    'salt' => mcrypt_create_iv(22, MCRYPT_DEV_URANDOM),
];

$email = $_POST['email'];
$password= password_hash($_POST['password'], PASSWORD_BCRYPT, $options);
$username= $_POST['username'];

$query = "INSERT INTO users (username, email, password) VALUES(?, ?, ?)";
$statement = $mysqli->prepare($query);

//bind parameters for markers, where (s = string, i = integer, d = double,  b = blob)
$statement->bind_param('sss', $username, $email, $password);

if($statement->execute()){
     print 'Success! ID of last inserted record is : ' .$statement->insert_id .'<br />'; 
}else{
     die('Error : ('. $mysqli->errno .') '. $mysqli->error);
}
$statement->close();
?>

Answer 1

While putting Users value into the variable is the perfect time to sanitize It would be great if you use a Global function to sanitize data and use that function everywhere

Here is an Example of secure code (without OOP ):

<?php

    // create a globa function
    // 
    function string_sanitize($value) {

        $search = array("\\",  "\x00", "\n",  "\r",  "'",  '"', "\x1a");
        $replace = array("\\\\","\\0","\\n", "\\r", "\'", '\"', "\\Z");

        return str_replace($search, $replace, $value);

    }

    function sanitize($value){

        return $this->string_sanitize(htmlentities(trim($value)));

    }

    //values to be inserted in database table
    //session_start();
    include('connect.php');
    $email = sanitize($_POST['email']);
   $username = sanitize($_POST['username']);

   // Sanitize password using hash()
   $password = hash('sha256', $_POST['password']);

    $query = "INSERT INTO users (username, email, password) VALUES(?, ?, ?)";
    $statement = $mysqli->prepare($query);

    //bind parameters for markers, where (s = string, i = integer, d = double,  b = blob)
    $statement->bind_param('sss', $username, $email, $password);


    if($statement->execute()){
         print 'Success! ID of last inserted record is : ' .$statement->insert_id .'<br />'; 
    }else{
         die('Error : ('. $mysqli->errno .') '. $mysqli->error);
    }
    $statement->close();


    ?>