Since scriptSig is a signed transaction hash with the spender's private key, how is the scriptsig different for each input?
yes, it is. For each input you create a raw transaction with the pubkey script in the scriptsig "slot". Then this raw tx gets seigned. Each input has a different "source" (previous input tx and previous input "outpoint"), since they are hashed before signing, it creates a different result. A sample how to do this for two inputs is shown here: