php & android howto prevent man-in-the-middle

Question

We works on a mobile app that using some web services as backend for db services and others services. We use a password approach for each user to prevent others to connect to ours services. My question is do we need to implements a token based system for preventing "man in the middle" attack? or using https.... or what is best. And if yes wich kind of lib or framework could help us? Now we protect our function with

if (password_verify($userPass, $hashedPass)) 
{
    return true;
}else
{
    return false;
}