PHP New User Creation

filter_input(INPUT_POST) does nothing

Although filter_input() can be very useful for validating and sanitizing data, when you use filter_var(INPUT_POST) you are actually not sanitizing anything. It just passes the raw data through and any invalid content you were hoping to remove, like HTML, will still be there. I believe what you are looking for is to use the FILTER_SANITIZE_STRING flag which will strip HTML from those values:

$new_user_usr = filter_input(INPUT_POST, 'username', FILTER_SANITIZE_STRING);
$new_user_pwd = filter_input(INPUT_POST, 'password', FILTER_SANITIZE_STRING);
$new_user_pwd_conf = filter_input(INPUT_POST, 'confirm_password', FILTER_SANITIZE_STRING);

Do your data validation and error handling sooner

In this code you go to the database to get users and then you do data validation that could cause your script to exit before you use that data. That's a waste of time and processing power. Don't do anything until you have to. So get your after you validate the other data.

Don't die()

It's good that you check for errors, but you handle them poorly. Terminating the executation of your code and dumping an error message out to the user is a bad user experience. You should capture those errors, probably in an array, and then display them in a user-friendly way so they have the opportunity to correct their mistakes and try again.

Your user check is extremely inefficient

You check to see if a user exists by iterating through every row in your table! That's just very slow and won't scale at all. You can easily narrow this down to a simple query that checks to see if anyone is using the same username. If you get any results back, you know someone is using that username.

// This code is insecure and I will fix that next
$sql = "SELECT usr FROM Users WHERE usr = '{$new_user_usr}'");
$result = $mysqli->query($sql);
if ($result->num_rows) {
    die("Username already taken");
}

You are wide open to SQL injections

our code is wide open to [SQL Injection][1] which is the [most dangerous web vulnerability][2]. This occurs when you execute SQL queries with unsanitized user data. By placing the raw $_POST variable directly in your query you are allowing an attacker to inject their own SQL into your query and execute it. They can do anything from stealing data to deleting your database.

To combat this you must use parameterized queries. Stack Overflow covers this very well but here's what your code would like if you use mysqli with prepared statements:

$stmt = $mysqli->prepare('SELECT usr FROM Users WHERE usr = ?');
$stmt->bind_param('s', $new_user_usr); // 's' specifies the variable type => 'string'
$stmt->execute();
$result = $stmt->get_result();
if ($result->num_rows) {
    die("Username already taken");
}

And:

$stmt = $mysqli->prepare('INSERT INTO Users (usr, pwd) VALUES (?, ?)');
$stmt->bind_param('ss', $new_user_usr, $new_user_pwd); 
$stmt->execute();
$result = $stmt->get_result();
if (!$result->affected_rows) {
    die("Username already taken");
}

Never store plain text passwords

Never, ever, store plain text passwords. It is a huge security nightmare and there is no excuse to do it. Please use PHP's built-in functions to handle password security.

// Do this *before* you insert into the database
$new_user_pwd = password_hash($new_user_pwd, PASSWORD_BCRYPT, $options);

// Do this when you want to verify a password
if (password_verify($new_user_pwd, $row['pwd'])) {
    echo 'Password is valid!';
} else {
    echo 'Invalid password.';
}

Make sure you don't escape passwords or use any other cleansing mechanism on them before hashing. Doing so changes the password and causes unnecessary additional coding.

Put your database credentials some more secure

Your database credentials are considered sensitive information and should be treated as such. Putting it in your PHP code potentially leaves it open to discovery. If your web server has an issue and instead of rendering your PHP code it displays it as plain text, your credentials will be publicly available for all to see. You should consider moving it to its own configuration file which is placed outside of your web root so it cannot be accessed through a browser at any time.

Separate concerns

Try to separate your HTML and business logic. It's okay to have PHP in your HTML templates for dynamic content, but business logic is best separated from your HTML as coupling them together makes your code less flexible and potentially more difficult to maintain.