fix session API broken and SQL pretection