Login PHP Ajax

<?php
error_reporting(E_ALL);
ini_set('display_errors', TRUE);
ini_set('display_startup_errors', TRUE);

date_default_timezone_set('Europe/Paris');
require('config.php');
session_start();

function get_ip(){
	if ( isset ( $_SERVER['HTTP_X_FORWARDED_FOR'] ) ){
		$ip = $_SERVER['HTTP_X_FORWARDED_FOR'];
	}elseif ( isset ( $_SERVER['HTTP_CLIENT_IP'] ) ){
		   $ip  = $_SERVER['HTTP_CLIENT_IP'];
	}else{
		$ip = $_SERVER['REMOTE_ADDR'];
	}
	return $ip;
}
$IP=get_ip();
$message='';
$username=$_REQUEST["username"];
echo '<br> username requiest = ' + $username;

$username=mysqli_real_escape_string($conn, $username);
echo '<br> username mysqli real escape string = ' + $username;

$password=$_REQUEST["password"];
echo '<br> password request = ' + $password;

$password=mysqli_real_escape_string($conn, $password);
echo '<br> password mysqli real escape string = ' + $password;

$password=hash('sha256', $password);
echo '<br> password hash = ' + $password;

	



function login($username, $password, $conn, $IP){

	$rlt = mysqli_query($conn, "SELECT * FROM `user` WHERE username='$username' and password='$password");
	$row = mysqli_num_rows($rlt);
	var_dump($row);
	if($row==1){
			
		$last = "UPDATE `user` SET last_login = NOW() , last_ip = '$IP' WHERE username='$username'LIMIT 1";
		$query = mysqli_query($conn, $last);
		$_SESSION['username'] = $username;
	}

}

if(login($username, $password, $conn, $IP)){
	$message = "Connection reussi";
	echo json_encode(array("statusCode"=>200));
}else{
	$message = "Erreur connection ";
	echo json_encode(array("statusCode"=>201));
}
setcookie('lgn-msg', $message , time()+3600*24);

?>

page.php?username=user&password=passwd