Improve security of SQL queries

[tmuras]

Please use placeholders when doing SQL queries. For example:

$data = $DB->execute("UPDATE {auth_otp_linked_login} SETconfirmtoken= null,otpcreated= null wherephone = '" . $phone . "'");
$sql = 'select * from {auth_otp_linked_login} wherephone= ' . $username . ' ANDconfirmtoken= ' . $password;
Instead of the second query, you can use $DB->get_records(). See https://docs.moodle.org/dev/Security:SQL_injection

[danmarsden]

this isn't fixed either... and it's a definite blocker.