login.php for help

$username = $_POST['username'];
$inPword = $_POST['password'];
$lat =  $_POST['lat'];
$lon =  $_POST['lon'];

$returnmessage = "";
$loggedin = "";

$password_hash = "";
$loggedinstatus = "";

$sel = mysqli_query($conn,"SELECT pword, loggedin FROM login WHERE uname = '$username'");

if(mysqli_num_rows($sel) < 1)
{
    $returnmessage = "BadLogin";
}

while($fetch = mysqli_fetch_array($sel,MYSQLI_ASSOC))
{
    $password_hash = $fetch['pword'];
    $loggedinstatus = $fetch['loggedin'];
}

if(crypt($inPword, $password_hash) == $password_hash)
{
    switch($loggedinstatus)
    {
        case  "no":
            $returnmessage = "AllGood";
            $sel = mysqli_query($conn,"UPDATE login SET loggedin='yes' WHERE uname = '$username'");
            break;
        defaut:
            $returnmessage = "alreadyin";
            break;
    }
}
else
{
    $returnmessage = "error";
}
echo json_encode(array("message" => $returnmessage, "uname" => $username));

mysqli_close($conn);