First, you are already passing user_phone and password in URL parameters, your php script can access them from there, you don't need to send them again in Data field.
If you need to send data in JSON string, you should wrap all text values in quotes, for example:
"{'phone':'" & user_phone & "', 'password':'" & password & "')"
or
"{""phone"":""" & user_phone & """, ""password"":""" & password & """)"
Or simply add these values into JSON object and use JSON.ToCompactString expression, it will format the string correctly for you.