I have the same error, although the $result = mysqli_query($conn, $sql) is the correct way around.
I var_dump() the $conn object and it is a set object at the time I run the query, but still returns a 'string given' error.
I was accessing the $conn object after being parsed into a function that I was using it with, in the same way I've done throughout the whole project without error.
Re-declaring the $conn object inside the function, instead of passing it into the function stopped the errors, although this behaviour doesn't occur anywhere else in my project. This isn't an ideal solution either.
To note: I'm using a .env for local development, which causes no issues and helps with deployment locally/remotely via .git.
After many hours, I honestly believe there is a PHP bug here, I'm using 7.3.0, but occurred in 7.2.5 as well as I'm definitely parsing it a db connection object, not a string.
Just posting this for information purposes, in case anyone else runs into it. Thanks.
PS. Passwords shouldn't be stored in the database in plain text and is a major security concern. If the author hasn't adjusted this yet (I know it's an old post), it's important to read:
Secure hash and salt for PHP passwords