will never return true when there is more than one value in the column.
Rearrange your database table so that instead of having comma-separated values within the “course” column, you have a separate table to store the courses that each student is taking. Check out “database normalisation” for more reading, trying to store more than one value in a single column is poor design.
You could use explode() on the course column and check whether the course id is present in the resulting array, but it’ll only get more complex as you need to do more with the data, so better to arrange it properly now.
either validate/sanitize the id before copying it or get rid of the unnecessary $level3 variable and use the id through the rest of the code to make it more obvious that there is a huge security hole there.