PHP mysqli code for login form
Did you know that anyone can set a cookie whenever they like? Imagine someone will set the "user" cookie to "admin".

Use any of popular PHP frameworks instead. They're here for a reason.

I'd also advise to use prepared statement if you absolutely have to write this kind of code yourself.

$query = "SELECT username, password FROM users WHERE username=? AND password=?";
if ($pst = $conn-&gt;prepare($query)) {
  $pst-&gt;bind_param("ss", $username, $password_hash);
  $pst-&gt;execute();
  if ($pst-&gt;num_rows) { 
    // logged in
  }
}