<?php
if(isset($_COOKIE['lgn_tkn']) && isset($_POST['email']) && isset($_POST['password'])) {
    include $_SERVER['SERVER_ROOT'].'/lib/connection.php';
    if(!$conn) {
        echo json_encode(["msg"=>"5"]);
    } else {
        $stmt = mysqli_prepare($conn,"SELECT * FROM `login-sessions` WHERE `token`=?");
        mysqli_stmt_bind_param($stmt,"s",$_COOKIE['lgn_tkn']);
        mysqli_stmt_execute($stmt);
        $result = mysqli_stmt_get_result($stmt);
        $num_rows = mysqli_num_rows($result);
        if($num_rows == 1) {
            while($row = mysqli_fetch_array($result)) {
                $attempts = $row['attemps'];
                if($attempts < 0) {
                    $stmt = mysqli_prepare($conn,"SELECT * FROM `users` WHERE `email` = ? AND `password` = ?");
                    mysqli_stmt_bind_param($conn,"ss",$_POST['email'], *password_hash*,PASSWORD_DEFAULT));
                    mysqli_stmt_execute($stmt);
                    $result = mysqli_stmt_get_result($stmt);
                    $num_rows = mysqli_num_rows($result);
                    if($num_rows == 1) {
                        while($row = mysqli_fetch_array($result)) {
                            session_start();
                            $_SESSION['username'] = $row['username'];
                            session_write_close();
                        }
                    } else {
                        $stmt = mysqli_prepare($conn,"SELECT * FROM `login-sessions` WHERE `token` = ?");
                        mysqli_stmt_bind_param($stmt,"s",[$_COOKIE['lgn_tkn']]);
                        mysqli_stmt_execute($stmt);
                        $result = mysqli_stmt_get_result($stmt);
                        if(mysqli_num_rows($result) != 0) {
                            $stmt = mysqli_prepare($conn,"UPDATE `login-sessions` set `attempts-left` = ? WHERE `token` = ?");
                            mysqli_stmt_bind_param($stmt,"ss",$attempts,$_COOKIE['lgn_tkn']);
                            if (mysqli_stmt_execute($stmt)) {
                                echo json_encode(["msg"=>"3"]);
                            } else {
                                echo json_encode(["msg"=>"5"]);
                            }

                        } else {
                            echo json_encode(["msg"=>"4"]);
                            exit;
                        }
                    }
                } else {
                    echo json_encode(["msg"=>"4"]);
                    $stmt = mysqli_prepare($conn,"DELETE FROM `login-sessions` WHERE `token` = ?");
                    mysqli_stmt_bind_param($stmt,"s",$_COOKIE['lgn_tkn']);
                    unset($_COOKIE['lgn_tkn']);
                    exit;
                }
            }
        } else {
            echo json_encode(["msg"=>"4"]);       
        }
    }
} else {
    echo json_encode(["msg"=>"1"]);
    exit;
}

This is my 1st socialmedia website im trying to make , i hope the code is secure enough to secure my users in database,
I also hided password hashing method to prevent hackers from gaining access to my website later if it worked
and also write any advice for later improvements for this code.
have a nice day 😉