This is the correct syntax for binding params in mysqli
$SQL = "SELECT
users.email,
users.handle,
userprofile.mobile
FROM users,userprofile
WHERE users.email =? OR users.handle =? OR userprofile.mobile=?";
if ($stmt = $mysqli->prepare($SQL)) {
$stmt->bind_param("sss", $one,$two,$three);
$stmt->execute();
//do stuff
}