add pin in courseDetail and fix SQL injection by session