PHP & Android how to prevent man-in-the-middle

Question

We work on a mobile app that using some web services as backend for db services and others services. We use a password approach for each user to prevent others to connect to our services. My question is do we need to implement a token based system for preventing "man in the middle" attack? or using https.... or what is best. And if yes which kind of lib or framework could help us? Now we protect our function with

if (password_verify($userPass, $hashedPass)) 
{
    return true;
}else
{
    return false;
}