// SQL Injection se bachne ka tarika
$stmt = $conn->prepare("UPDATE users SET balance = balance + ? WHERE id = ?");
$stmt->bind_param("di", $reward, $user_id);
$stmt->execute();