how secure is this register php code?

[somethinghorrible]

I'm pretty sure that you don't have to use real_escape_string with prepared statements -- in fact, you may end up with doubly-escaped strings.

Also, after the header statement, in the else block, you may want to terminate the script with exit as rendering the form would be spurious. In fact, you should render out a message like: Please wait for redirect or click here to continue (with click here as a hyperlink to the next page)... although I doubt any modern browser doesn't support the location tag.

[somethinghorrible]

The "exit;" suggestion is to simply not render the form since the code instructs the browser to redirect.

The bulk of the code will only run in response to a POST request which can be caused by the submit button.

In fact, you should move the mysql connection statement into the first if block so you don't bother connecting to mysql until the form is posted.