Would love you input whether I left any security holes. Username/password are never passed back and forth, only the unique hash. Hash is removed from the data

Would love you input whether I left any security holes. Username/password are never passed back and forth, only the unique hash. Hash is removed from the database once it’s used, old hashes that haven’t been used can’t be unless the database is hacked, but then you have bigger issues. All database queries of the hash have been escaped to prevent XSS attacks.