I'm making a login system to my website, but the browser says it is not secured: the browser's message

Heres is my html:

<div id="loginform">
      Bejelentkezés
      <input type="text" placeholder="E-mail" id="email"></input>
      <input type="password" placeholder="Jelszó" id="password"></input>
      <button id="loginbutton">Bejelentkezés</button>
      <div id="errormsg"></div>
    </div>

Here is my Ajax:

 $("#loginbutton").click(function(){
          var user ={
            email: $('#email').val(),
            password: $('#password').val()
          };

            $.ajax({
            url: 'login.php',
            type: 'POST',
            dataType: "json",
            data: {"user": JSON.stringify(user)},
            success: function(data){
              if(data.success){
                alert(data.user_id);
              }
              else{
                document.getElementById("errormsg").innerHTML = "A bejelentkezés sikertelen";
              }
            }
          });
         });

And my PHP:

<?php
 session_start();
 $conn = mysqli_connect("localhost", "root", "", "getpet");

 $results = array(
   'success' => false,
   'user_id' => "azaz",
   'fname' => "",
   'lname' => ""
 );
 if(isset($_POST['user'])){
    $user = json_decode($_POST['user']);
        $email = $user->email;
        $password = md5($user->password);
        $sql= "SELECT * FROM users WHERE email = '".$email."' AND password = '".$password."'";
        $rowsql = mysqli_query($conn, $sql);
        $row = mysqli_fetch_array($rowsql, MYSQLI_BOTH);
        if(mysqli_num_rows($rowsql) == "1"){
            $_SESSION['user_id'] = $row['user_id'];
            $_SESSION['fname'] = $row['fname'];
            $_SESSION['lname'] = $row['lname'];

      $results['success'] = true;
      $results['user_id'] = $row['user_id'];
      $results['fname'] = $row['fname'];
      $results['lname'] = $row['lname'];
      }
    }
    else{
      $results['user_id']= "VAnbaj";
    }

            echo json_encode($results);
 ?>

It works, but i don't know how to make it safe. I'd be glad if somebody can help me.