From: nicolasconnault <nicolasconnault>
Date: Mon, 9 Jun 2008 10:00:35 +0000 (+0000)
Subject: MDL-15113 Upgrade to DMLLIB 2.0. Needs further testing and bug-fixing.
X-Git-Url: http://git.mjollnir.org/gw?a=commitdiff_plain;h=9cf4a18b41cdad00aec5b42eb4d03ebcc2283d36;p=moodle.git

MDL-15113 Upgrade to DMLLIB 2.0. Needs further testing and bug-fixing.
MDL-15100 Fixed a bug in gradelib.php
Plus edited tablelib.php for table_sql upgrade to dmllib 2.0
---

diff --git a/lib/gradelib.php b/lib/gradelib.php
index 7c078e0fb8..ec2a676197 100644
--- a/lib/gradelib.php
+++ b/lib/gradelib.php
@@ -209,7 +209,7 @@ function grade_update($source, $courseid, $itemtype, $itemmodule, $iteminstance,
 
     $count = count($grades);
     if ($count > 0 and $count < 200) {
-        list($uids, $params) = $DB->get_in_or_equal(array_keys($grades), SQL_PARAMS_NAMED, $start='uid0'); 
+        list($uids, $params) = $DB->get_in_or_equal(array_keys($grades), SQL_PARAMS_NAMED, $start='uid0');
         $params['gid'] = $grade_item->id;
         $sql = "SELECT * FROM {grade_grades} WHERE itemid = :gid AND userid $uids";
 
@@ -226,11 +226,8 @@ function grade_update($source, $courseid, $itemtype, $itemmodule, $iteminstance,
         $grade_grade = null;
         $grade       = null;
 
-        while ($rs and $rs->valid()) {
-            $rs->next();
-            if (!$gd = $rs->current()) {
-                break;
-            }
+        foreach ($rs as $gd) {
+
             $userid = $gd->userid;
             if (!isset($grades[$userid])) {
                 // this grade not requested, continue
@@ -243,6 +240,7 @@ function grade_update($source, $courseid, $itemtype, $itemmodule, $iteminstance,
             break;
         }
 
+
         if (is_null($grade_grade)) {
             if (count($grades) == 0) {
                 // no more grades to process
diff --git a/lib/tablelib.php b/lib/tablelib.php
index 3504216cc0..166de5e0c1 100644
--- a/lib/tablelib.php
+++ b/lib/tablelib.php
@@ -37,7 +37,7 @@ class flexible_table {
     var $totalrows   = 0;
     var $sort_default_column = NULL;
     var $sort_default_order  = SORT_ASC;
-    
+
     /**
      * Array of positions in which to display download controls.
      */
@@ -49,26 +49,26 @@ class flexible_table {
      * passes in cleaned data from $
      */
     var $download  = '';
-    
+
     /**
      * @var boolean whether data is downloadable from table. Determines whether
      * to display download buttons. Set by method downloadable().
      */
     var $downloadable = false;
-    
+
     /**
      * @var string which download plugin to use. Default '' means none - print
      * html table with paging.
      */
     var $defaultdownloadformat  = 'csv';
-    
+
     /**
      * @var boolean Has start output been called yet?
      */
     var $started_output = false;
-    
+
     var $exportclass = null;
-    
+
     /**
      * Constructor
      * @param int $uniqueid
@@ -115,7 +115,7 @@ class flexible_table {
     /**
      * Probably don't need to call this directly. Calling is_downloading with a
      * param automatically sets table as downloadable.
-     * 
+     *
      * @param boolean $downloadable optional param to set whether data from
      * table is downloadable. If ommitted this function can be used to get
      * current state of table.
@@ -127,7 +127,7 @@ class flexible_table {
         }
         return $this->downloadable;
     }
-    
+
     /**
      * Where to show download buttons.
      * @param array $showat array of postions in which to show download buttons.
@@ -136,10 +136,10 @@ class flexible_table {
     function show_download_buttons_at($showat){
         $this->showdownloadbuttonsat = $showat;
     }
-    
-    
+
+
     /**
-     * Sets the is_sortable variable to the given boolean, sort_default_column to 
+     * Sets the is_sortable variable to the given boolean, sort_default_column to
      * the given string, and the sort_default_order to the given integer.
      * @param bool $bool
      * @param string $defaultcolumn
@@ -239,9 +239,9 @@ class flexible_table {
     }
 
     /**
-     * What this method does is set the column so that if the same data appears in 
+     * What this method does is set the column so that if the same data appears in
      * consecutive rows, then it is not repeated.
-     * 
+     *
      * For example, in the quiz overview report, the fullname column is set to be suppressed, so
      * that when one student has made multiple attempts, their name is only printed in the row
      * for their first attempt.
@@ -329,7 +329,7 @@ class flexible_table {
     function define_headers($headers) {
         $this->headers = $headers;
     }
-    
+
 
 
 
@@ -559,19 +559,19 @@ class flexible_table {
     }
 
     /**
-     * Add a row of data to the table. This function takes an array with 
-     * column names as keys. 
+     * Add a row of data to the table. This function takes an array with
+     * column names as keys.
      * It ignores any elements with keys that are not defined as columns. It
      * puts in empty strings into the row when there is no element in the passed
      * array corresponding to a column in the table. It puts the row elements in
      * the proper order.
      * @param $rowwithkeys array
-     * 
+     *
      */
     function add_data_keyed($rowwithkeys){
         $this->add_data($this->get_row_from_keyed($rowwithkeys));
     }
-    
+
     /**
      * Add a seperator line to table.
      */
@@ -581,14 +581,14 @@ class flexible_table {
         }
         $this->add_data(NULL);
     }
-    
+
     /**
      * This method actually directly echoes the row passed to it now or adds it
      * to the download. If this is the first row and start_output has not
      * already been called this method also calls start_output to open the table
      * or send headers for the downloaded.
      * Can be used as before. print_html now calls finish_html to close table.
-     * 
+     *
      * @param array $row a numerically keyed row of data to add to the table.
      * @return boolean success.
      */
@@ -616,7 +616,7 @@ class flexible_table {
     /**
      * You should call this to finish outputting the table data after adding
      * data to the table with add_data or add_data_keyed.
-     * 
+     *
      */
     function finish_output(){
         if ($this->exportclass!==null){
@@ -625,7 +625,7 @@ class flexible_table {
             $this->finish_html();
         }
     }
-    
+
     /**
      * Hook that can be overridden in child classes to wrap a table in a form
      * for example. Called only when there is data to display and not
@@ -641,7 +641,7 @@ class flexible_table {
      */
     function wrap_html_finish(){
     }
-    
+
     /**
      * This method is deprecated although the old api is still supported.
      * @deprecated 1.9.2 - Jun 2, 2008
@@ -676,18 +676,18 @@ class flexible_table {
 
         return $this->sess->i_last;
     }
-    
+
     /**
      * This function is not part of the public api.
      */
     function print_initials_bar(){
         if($this->use_initials && isset($this->columns['fullname'])) {
-    
+
             $strall = get_string('all');
             $alpha  = explode(',', get_string('alphabet'));
-    
+
             // Bar of first initials
-         
+
             echo '<div class="initialbar firstinitial">'.get_string('firstname').' : ';
             if(!empty($this->sess->i_first)) {
                 echo '<a href="'.$this->baseurl.$this->request[TABLE_VAR_IFIRST].'=">'.$strall.'</a>';
@@ -702,9 +702,9 @@ class flexible_table {
                 }
             }
             echo '</div>';
-    
+
             // Bar of last initials
-    
+
             echo '<div class="initialbar lastinitial">'.get_string('lastname').' : ';
             if(!empty($this->sess->i_last)) {
                 echo '<a href="'.$this->baseurl.$this->request[TABLE_VAR_ILAST].'=">'.$strall.'</a>';
@@ -719,7 +719,7 @@ class flexible_table {
                 }
             }
             echo '</div>';
-    
+
         }
     }
 
@@ -766,7 +766,7 @@ class flexible_table {
         }
         return $exportclasses;
     }
-    
+
     /**
      * This function is not part of the public api.
      */
@@ -789,7 +789,7 @@ class flexible_table {
      * This function is not part of the public api.
      * You don't normally need to call this. It is called automatically when
      * needed when you start adding data to the table.
-     * 
+     *
      */
     function start_output(){
         $this->started_output = true;
@@ -859,7 +859,7 @@ class flexible_table {
                 print_paging_bar($this->totalrows, $this->currpage, $this->pagesize, $this->baseurl, $this->request[TABLE_VAR_PAGE]);
             }
         }
-    }    
+    }
     /**
      * This function is not part of the public api.
      */
@@ -925,7 +925,7 @@ class flexible_table {
                 break;
 
                 case 'userpic':
-                    // do nothing, do not display sortable links      
+                    // do nothing, do not display sortable links
                 break;
 
                 default:
@@ -940,7 +940,7 @@ class flexible_table {
                             $localsortorder = get_string('desc');
                         }
                     } else {
-                        $localsortorder = get_string('asc');  
+                        $localsortorder = get_string('asc');
                     }
                     $this->headers[$index] = '<a href="'.$this->baseurl.$this->request[TABLE_VAR_SORT].'='.$column.'">'.$this->headers[$index].get_accesshide(get_string('sortby').' '.$this->headers[$index].' '.$localsortorder).'</a>';
                 }
@@ -967,12 +967,12 @@ class flexible_table {
         }
         echo '</tr>';
     }
-    
+
     /**
      * This function is not part of the public api.
      */
     function start_html(){
-            
+
         // Do we need to print initial bars?
         $this->print_initials_bar();
 
@@ -980,16 +980,16 @@ class flexible_table {
         if($this->use_pages) {
             print_paging_bar($this->totalrows, $this->currpage, $this->pagesize, $this->baseurl, $this->request[TABLE_VAR_PAGE]);
         }
-        
+
         if(in_array(TABLE_P_TOP, $this->showdownloadbuttonsat)) {
             echo $this->download_buttons();
         }
-        
+
         $this->wrap_html_start();
         // Start of main data table
 
         echo '<table'.$this->make_attributes_string($this->attributes).'>';
-        
+
     }
 
     /**
@@ -1030,32 +1030,33 @@ class flexible_table {
 }
 
 class table_sql extends flexible_table{
-    
-    var $countsql = NULL;
+
+    public $countsql = NULL;
+    public $countparams = NULL;
     /**
-     * @var object sql for querying db. Has fields 'fields', 'from', 'where'.
+     * @var object sql for querying db. Has fields 'fields', 'from', 'where', 'params'.
      */
-    var $sql = NULL;
+    public $sql = NULL;
     /**
      * @var array Data fetched from the db.
      */
-    var $rawdata = NULL;
-    
+    public $rawdata = NULL;
+
     /**
      * @var boolean Overriding default for this.
      */
-    var $is_sortable    = true;
+    public $is_sortable    = true;
     /**
      * @var boolean Overriding default for this.
      */
-    var $is_collapsible = true;
-    
+    public $is_collapsible = true;
+
     /**
      * @var string Key of field returned by db query that is the id field of the
      * user table or equivalent.
      */
-    var $useridfield = 'id';
-    
+    public $useridfield = 'id';
+
 
     /**
      * @param string $uniqueid a string identifying this table.Used as a key in
@@ -1067,9 +1068,9 @@ class table_sql extends flexible_table{
         $this->set_attribute('cellspacing', '0');
         $this->set_attribute('class', 'generaltable generalbox');
     }
-    
+
     /**
-     * 
+     *
      * @param array $row row of data from db used to make one row of the table.
      * @return array one row for the table, added using add_data_keyed method.
      */
@@ -1089,26 +1090,26 @@ class table_sql extends flexible_table{
         }
         return $formattedrow;
     }
-    
+
     /**
      * Fullname is treated as a special columname in tablelib and should always
      * be treated the same as the fullname of a user.
      * @uses $this->useridfield if the userid field is not expected to be id
      * then you need to override $this->useridfield to point at the correct
      * field for the user id.
-     * 
+     *
      */
     function col_fullname($row){
         global $COURSE, $CFG;
         if (!$this->download){
-            
+
             return '<a href="'.$CFG->wwwroot.'/user/view.php?id='.$row->{$this->useridfield}.
                     '&amp;course='.$COURSE->id.'">'.fullname($row).'</a>';
         } else {
             return fullname($row);
         }
     }
-    
+
     /**
      * You can override this method in a child class. See the description of
      * build_table which calls this method.
@@ -1132,55 +1133,58 @@ class table_sql extends flexible_table{
         }
     }
 
-    
+
     /**
      * This is only needed if you want to use different sql to count rows.
      * Used for example when perhaps all db JOINS are not needed when counting
      * records. You don't need to call this function the count_sql
      * will be generated automatically.
-     * 
+     *
      * We need to count rows returned by the db seperately to the query itself
      * as we need to know how many pages of data we have to display.
      */
-    function set_count_sql($sql){
+    function set_count_sql($sql, $params=array()){
         $this->countsql = $sql;
+        $this->countparams = $params;
     }
-    
+
     /**
      * Set the sql to query the db. Query will be :
      *      SELECT $fields FROM $from WHERE $where
      * Of course you can use sub-queries, JOINS etc. by putting them in the
      * appropriate clause of the query.
      */
-    function set_sql($fields, $from, $where){
+    function set_sql($fields, $from, $where, $params=array()){
         $this->sql = new object();
         $this->sql->fields = $fields;
         $this->sql->from = $from;
         $this->sql->where = $where;
+        $this->sql->params = $params;
     }
-    
+
     /**
      * Query the db. Store results in the table object for use by build_table.
-     * 
+     *
      * @param integer $pagesize size of page for paginated displayed table.
      * @param boolean $useinitialsbar do you want to use the initials bar. Bar
      * will only be used if there is a fullname column defined for the table.
      */
     function query_db($pagesize, $useinitialsbar=true){
+        global $DB;
         if (!$this->is_downloading()) {
             if ($this->countsql === NULL){
                 $this->countsql = 'SELECT COUNT(1) FROM '.$this->sql->from.' WHERE '.$this->sql->where;
             }
             if ($useinitialsbar && !$this->is_downloading()) {
-                $totalinitials = count_records_sql($this->countsql);
+                $totalinitials = $DB->count_records_sql($this->countsql, $this->countparams);
                 $this->initialbars($totalinitials>$pagesize);
             }
-            
+
             if ($this->get_sql_where()) {
                 $this->countsql .= ' AND '.$this->get_sql_where();
                 $this->sql->where .= ' AND '.$this->get_sql_where();
             }
-            $total  = count_records_sql($this->countsql);
+            $total  = $DB->count_records_sql($this->countsql, $this->countparams);
 
 
             $this->pagesize($pagesize, $total);
@@ -1191,20 +1195,21 @@ class table_sql extends flexible_table{
         $sort = $sort?" ORDER BY {$sort}":'';
         $sql = "SELECT {$this->sql->fields} FROM {$this->sql->from} WHERE {$this->sql->where}{$sort}";
         if (!$this->is_downloading()) {
-            $this->rawdata = get_records_sql($sql, $this->get_page_start(), $this->get_page_size());
+            $this->rawdata = $DB->get_records_sql($sql, $this->sql->params, $this->get_page_start(), $this->get_page_size());
         } else {
-            $this->rawdata = get_records_sql($sql);
+            $this->rawdata = $DB->get_records_sql($sql, $this->sql->params);
         }
     }
-    
-    
+
+
     /**
      * Convenience method to call a number of methods for you to display the
      * table.
      */
     function out($pagesize, $useinitialsbar, $downloadhelpbutton=''){
+        global $DB;
         if (!$this->columns){
-            $onerow = get_record_sql("SELECT {$this->sql->fields} FROM {$this->sql->from} WHERE {$this->sql->where}", true);
+            $onerow = $DB->get_record_sql("SELECT {$this->sql->fields} FROM {$this->sql->from} WHERE {$this->sql->where}", $this->sql->params);
             //if columns is not set then define columns as the keys of the rows returned
             //from the db.
             $this->define_columns(array_keys((array)$onerow));
@@ -1250,11 +1255,11 @@ class table_spreadsheet_export_format_parent extends table_default_export_format
      */
     var $formatheaders;
 
-    /** 
+    /**
      * should be overriden in child class.
      */
     var $fileextension;
-    
+
     /**
      * This method will be overridden in the child class.
      */
@@ -1372,16 +1377,16 @@ class table_xhtml_export_format extends table_default_export_format_parent{
         header("Expires: 0");
         header("Cache-Control: must-revalidate,post-check=0,pre-check=0");
         header("Pragma: public");
-        
+
         //html headers
-        
+
         echo <<<EOF
 <?xml version="1.0" encoding="UTF-8"?>
 <!DOCTYPE html
   PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN"
-  "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> 
+  "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
 
-<html xmlns="http://www.w3.org/1999/xhtml" 
+<html xmlns="http://www.w3.org/1999/xhtml"
   xml:lang="en" lang="en">
 <style type="text/css">/*<![CDATA[*/
 
diff --git a/mod/quiz/attempt.php b/mod/quiz/attempt.php
index 78e893058e..307e20af77 100644
--- a/mod/quiz/attempt.php
+++ b/mod/quiz/attempt.php
@@ -30,17 +30,17 @@
         if (! $cm = get_coursemodule_from_id('quiz', $id)) {
             print_error("There is no coursemodule with id $id");
         }
-        if (! $course = get_record("course", "id", $cm->course)) {
+        if (! $course = $DB->get_record('course', array('id' => $cm->course))) {
             print_error("Course is misconfigured");
         }
-        if (! $quiz = get_record("quiz", "id", $cm->instance)) {
+        if (! $quiz = $DB->get_record('quiz', array('id' => $cm->instance))) {
             print_error("The quiz with id $cm->instance corresponding to this coursemodule $id is missing");
         }
     } else {
-        if (! $quiz = get_record("quiz", "id", $q)) {
+        if (! $quiz = $DB->get_record('quiz', array('id' => $q))) {
             print_error("There is no quiz with id $q");
         }
-        if (! $course = get_record("course", "id", $quiz->course)) {
+        if (! $course = $DB->get_record('course', array('id' => $quiz->course))) {
             print_error("The course with id $quiz->course that the quiz with id $q belongs to is missing");
         }
         if (! $cm = get_coursemodule_from_instance("quiz", $quiz->id, $course->id)) {
@@ -85,7 +85,7 @@
     if ($canpreview && $forcenew) {
     /// Teacher wants a new preview, so we set a finish time on the
     /// current attempt (if any). It will then automatically be deleted below
-        set_field('quiz_attempts', 'timefinish', $timenow, 'quiz', $quiz->id, 'userid', $USER->id);
+        $DB->set_field('quiz_attempts', 'timefinish', $timenow, array('quiz' => $quiz->id, 'userid' => $USER->id));
     }
 
 /// Look for an existing attempt.
@@ -128,8 +128,8 @@
         $accessmanager->do_password_check($canpreview);
 
     /// Delete any previous preview attempts belonging to this user.
-        if ($oldattempts = get_records_select('quiz_attempts', "quiz = '$quiz->id'
-                AND userid = '$USER->id' AND preview = 1")) {
+        if ($oldattempts = $DB->get_records_select('quiz_attempts', "quiz = ?
+                AND userid = ? AND preview = 1", array($quiz->id, $USER->id))) {
             foreach ($oldattempts as $oldattempt) {
                 quiz_delete_attempt($oldattempt, $quiz);
             }
@@ -139,7 +139,7 @@
         $attempt = quiz_create_attempt($quiz, $attemptnumber, $lastattempt, $timenow, $canpreview);
 
     /// Save the attempt in the database.
-        if (!$attempt->id = insert_record('quiz_attempts', $attempt)) {
+        if (!$attempt->id = $DB->insert_record('quiz_attempts', $attempt)) {
             quiz_error($quiz, 'newattemptfail');
         }
 
@@ -238,7 +238,7 @@
         }
 
         $attempt->timemodified = $timenow;
-        if (!update_record('quiz_attempts', $attempt)) {
+        if (!$DB->update_record('quiz_attempts', $attempt)) {
             quiz_error($quiz, 'saveattemptfailed');
         }
     }
@@ -263,7 +263,7 @@
                 "$quiz->id", $cm->id);
 
     /// Update the quiz attempt record.
-        if (!update_record('quiz_attempts', $attempt)) {
+        if (!$DB->update_record('quiz_attempts', $attempt)) {
             quiz_error($quiz, 'saveattemptfailed');
         }
 
@@ -371,7 +371,7 @@
     }
 
 /// Print the submit buttons
-    $strconfirmattempt = addslashes(get_string("confirmclose", "quiz"));
+    $strconfirmattempt = get_string("confirmclose", "quiz");
     $onclick = "return confirm('$strconfirmattempt')";
     echo "<div class=\"submitbtns mdl-align\">\n";
 
diff --git a/mod/quiz/backuplib.php b/mod/quiz/backuplib.php
index 962a086baa..c817c88db8 100644
--- a/mod/quiz/backuplib.php
+++ b/mod/quiz/backuplib.php
@@ -39,7 +39,7 @@
      *     all categories and questions in contexts above course level that are used by quizzes that have been selected for backup
      */
     function quiz_insert_category_and_question_ids($course, $backup_unique_code, $instances = null) {
-        global $CFG;
+        global $CFG, $DB;
         $status = true;
 
         // Create missing categories and reasign orphaned questions.
@@ -55,45 +55,50 @@
         // Then categories from parent contexts used by the quizzes we are backing up.
         //TODO this will need generalising when we have modules other than quiz using shared questions above course level.
         $parentcontexts = get_parent_contexts($coursecontext);
-        $from = "{$CFG->prefix}quiz quiz,";
-        $where = "AND quiz.course = '$course'
+        $params = array($course);
+        $from = "{quiz} quiz,";
+        $where = "AND quiz.course = ?
                      AND qqi.quiz = quiz.id";
         if (!empty($instances) && is_array($instances) && count($instances)) {
             $questionselectsqlfrom = '';
-            $questionselectsqlwhere = 'AND qqi.quiz IN ('.implode(',',array_keys($instances)).')';
+            list($quiz_usql, $quiz_params) = $DB->get_in_or_equal(array_keys($instances));
+            $questionselectsqlwhere = "AND qqi.quiz $quiz_usql";
+            $params = array_merge($params, $quiz_params);
         } else {
-            $questionselectsqlfrom = "{$CFG->prefix}quiz quiz,";
-            $questionselectsqlwhere = "AND quiz.course = '$course'
-                         AND qqi.quiz = quiz.id";
+            $questionselectsqlfrom = "{quiz} quiz,";
+            $questionselectsqlwhere = "AND quiz.course = ? AND qqi.quiz = quiz.id";
+            $params[] = $course;
         }
-        $categories = get_records_sql("
+
+        list($usql, $context_params) = $DB->get_in_or_equal($parentcontexts);
+        $params = array_merge($context_params, $params);
+        $categories = $DB->get_records_sql("
                 SELECT id, parent, 0 AS childrendone
-                FROM {$CFG->prefix}question_categories
-                WHERE contextid IN (".join($parentcontexts, ', ').")
+                FROM {question_categories}
+                WHERE contextid $usql
                   AND id IN (
                     SELECT DISTINCT question.category
-                    FROM {$CFG->prefix}question question,
+                    FROM {question} question,
                          $questionselectsqlfrom
-                         {$CFG->prefix}quiz_question_instances qqi
+                         {quiz_question_instances} qqi
                     WHERE qqi.question = question.id
                       $questionselectsqlwhere
-                )", false);
+                )", $params);
         if (!$categories) {
             $categories = array();
         } else {
             //put the ids of the used questions from all these categories into the db.
-            $status = $status && execute_sql("INSERT INTO {$CFG->prefix}backup_ids
+            $status = $status && $DB->execute("INSERT INTO {backup_ids}
                                        (backup_code, table_name, old_id, info)
                                        SELECT DISTINCT $backup_unique_code, 'question', q.id, ''
-                                       FROM {$CFG->prefix}question q,
+                                       FROM {question} q,
                                        $from
-                                       {$CFG->prefix}question_categories qc,
-                                       {$CFG->prefix}quiz_question_instances qqi
+                                       {question_categories} qc,
+                                       {quiz_question_instances} qqi
                                        WHERE (qqi.question = q.id
                                        OR qqi.question = q.parent)
                                        AND q.category = qc.id
-                                       AND qc.contextid IN (".join($parentcontexts, ', ').")
-                                       $where", false);
+                                       AND qc.contextid $usql $where", array_merge($context_params, array($course)));
 
             // Add the parent categories, of these categories up to the top of the category tree.
             // not backing up the questions in these categories.
@@ -104,12 +109,12 @@
                         break;
                     }
                     $currentid = $category->id;
-                    $category = get_record('question_categories', 'id', $category->parent, '', '', '', '', 'id, parent, 0 AS childrendone');
+                    $category = $DB->get_record('question_categories', array('id' => $category->parent), 'id, parent, 0 AS childrendone');
                     if ($category) {
                         $categories[$category->id] = $category;
                     } else {
                         // Parent not found: this indicates an error, but just fix it.
-                        set_field('question_categories', 'parent', 0, 'id', $currentid);
+                        $DB->set_field('question_categories', 'parent', 0, array('id' => $currentid));
                         break;
                     }
                 }
@@ -119,17 +124,17 @@
             // in our quizzes that select from the category and its subcategories. That implies
             // those subcategories also need to be backed up. (The categories themselves
             // and their parents will already have been included.)
-            $categorieswithrandom = get_records_sql("
+            $categorieswithrandom = $DB->get_records_sql("
                     SELECT question.category AS id, SUM(" .
                             sql_cast_char2int('questiontext', true) . ") AS numqsusingsubcategories
-                    FROM {$CFG->prefix}quiz_question_instances qqi,
+                    FROM {quiz_question_instances} qqi,
                          $from
-                         {$CFG->prefix}question question
+                         {question} question
                     WHERE question.id = qqi.question
                       AND question.qtype = '" . RANDOM . "'
                       $where
                     GROUP BY question.category
-                    ");
+                    ", array($course));
             $randomselectedquestions = array();
             if ($categorieswithrandom) {
                 foreach ($categorieswithrandom as $category) {
@@ -137,10 +142,11 @@
                         $status = $status && quiz_backup_add_sub_categories($categories, $randomselectedquestions, $category->id);
                     }
                 }
-                $returnval = get_records_sql("
+                list($usql, $params) = $DB->get_in_or_equal(array_keys($categorieswithrandom));
+                $returnval = $DB->get_records_sql("
                     SELECT question.id
-                    FROM {$CFG->prefix}question question
-                    WHERE question.category IN  (".join(array_keys($categorieswithrandom), ', ').")");
+                    FROM {question} question
+                    WHERE question.category $usql", $params);
                 if ($returnval) {
                     $randomselectedquestions += $returnval;
                 }
@@ -162,24 +168,23 @@
      * Helper function adding the id of all the subcategories of a category to an array.
      */
     function quiz_backup_add_sub_categories(&$categories, &$questions, $categoryid) {
-        global $CFG;
+        global $CFG, $DB;
         $status = true;
         if ($categories[$categoryid]->childrendone) {
             return $status;
         }
-        if ($subcategories = get_records('question_categories', 'parent', $categoryid, '', 'id, 0 AS childrendone')) {
+        if ($subcategories = $DB->get_records('question_categories', array('parent' => $categoryid), '', 'id, 0 AS childrendone')) {
             foreach ($subcategories as $subcategory) {
                 if (!array_key_exists($subcategory->id, $categories)) {
                     $categories[$subcategory->id] = $subcategory;
                 }
                 $status = $status && quiz_backup_add_sub_categories($categories, $questions, $subcategory->id);
             }
-            $subcatlist = join(array_keys($subcategories), ',');
-            $returnval = get_records_sql("
+            list($usql, $params) = $DB->get_in_or_equal(array_keys($subcategories));
+            $returnval = $DB->get_records_sql("
                 SELECT question.id
-                FROM {$CFG->prefix}question question
-                WHERE question.category IN ($subcatlist)
-                ");
+                FROM {question} question
+                WHERE question.category $usql", $params);
             if ($returnval) {
                 $questions += $returnval;
             }
@@ -195,18 +200,18 @@
     //executed in the upgrade process and, perhaps in the health center.
     function quiz_fix_orphaned_questions ($course) {
 
-        global $CFG;
+        global $CFG, $DB;
 
-        $categories = get_records_sql("SELECT DISTINCT t.category, t.category
-                                       FROM {$CFG->prefix}question t,
-                                            {$CFG->prefix}quiz_question_instances g,
-                                            {$CFG->prefix}quiz q
-                                       WHERE q.course = '$course' AND
-                                             g.quiz = q.id AND
-                                             g.question = t.id",false);
+        $categories = $DB->get_records_sql("SELECT DISTINCT t.category, t.category
+                                           FROM {question} t,
+                                                {quiz_question_instances} g,
+                                                {quiz} q
+                                           WHERE q.course = ? AND
+                                                 g.quiz = q.id AND
+                                                 g.question = t.id",false, array($course));
         if ($categories) {
             foreach ($categories as $key => $category) {
-                $exist = get_record('question_categories','id', $key);
+                $exist = $DB->get_record('question_categories', array('id' => $key));
                 //If the category doesn't exist
                 if (!$exist) {
                     //Build a new category
@@ -217,11 +222,11 @@
                     $db_cat->info = get_string('recreatedcategory','',$key);
                     $db_cat->stamp = make_unique_id_code();
                     //Insert the new category
-                    $catid = insert_record('question_categories',$db_cat);
+                    $catid = $DB->insert_record('question_categories',$db_cat);
                     unset ($db_cat);
                     if ($catid) {
                         //Reasign orphaned questions to their new category
-                        set_field ('question','category',$catid,'category',$key);
+                        $DB->set_field ('question','category',$catid,array('category' =>$key));
                     }
                 }
             }
@@ -233,10 +238,11 @@
     //    (course dependent)
 
     function quiz_backup_one_mod($bf,$preferences,$quiz) {
+        global $DB;
         $status = true;
 
         if (is_numeric($quiz)) {
-            $quiz = get_record('quiz','id',$quiz);
+            $quiz = $DB->get_record('quiz', array('id' => $quiz));
         }
 
         //Start mod
@@ -292,13 +298,14 @@
 
 
     function quiz_backup_mods($bf,$preferences) {
+        global $DB;
 
         global $CFG;
 
         $status = true;
 
         //Iterate over quiz table
-        $quizzes = get_records ("quiz","course",$preferences->backup_course,"id");
+        $quizzes = $DB->get_records('quiz',array('course' => $preferences->backup_course),'id');
         if ($quizzes) {
             foreach ($quizzes as $quiz) {
                 if (backup_mod_selected($preferences,'quiz',$quiz->id)) {
@@ -311,9 +318,10 @@
 
     //Backup quiz_question_instances contents (executed from quiz_backup_mods)
     function backup_quiz_question_instances ($bf,$preferences,$quiz) {
+        global $DB;
         $status = true;
 
-        $quiz_question_instances = get_records("quiz_question_instances","quiz",$quiz,"id");
+        $quiz_question_instances = $DB->get_records('quiz_question_instances',array('quiz' =>$quiz),'id');
         //If there are question_instances
         if ($quiz_question_instances) {
             //Write start tag
@@ -337,9 +345,10 @@
 
     //Backup quiz_question_instances contents (executed from quiz_backup_mods)
     function backup_quiz_feedback ($bf,$preferences,$quiz) {
+        global $DB;
         $status = true;
 
-        $quiz_feedback = get_records('quiz_feedback', 'quizid', $quiz, 'id');
+        $quiz_feedback = $DB->get_records('quiz_feedback', array('quizid' => $quiz), 'id');
         // If there are question_instances ...
         if ($quiz_feedback) {
             // Write start tag.
@@ -370,9 +379,10 @@
 
     //Backup quiz_question_versions contents (executed from quiz_backup_mods)
     function backup_quiz_question_versions ($bf,$preferences,$quiz) {
+        global $DB;
         $status = true;
 
-        $quiz_question_versions = get_records("quiz_question_versions","quiz",$quiz,"id");
+        $quiz_question_versions = $DB->get_records('quiz_question_versions', array('quiz' =>$quiz),'id');
         //If there are question_versions
         if ($quiz_question_versions) {
             //Write start tag
@@ -400,9 +410,10 @@
 
     //Backup quiz_grades contents (executed from quiz_backup_mods)
     function backup_quiz_grades ($bf,$preferences,$quiz) {
+        global $DB;
         $status = true;
 
-        $quiz_grades = get_records("quiz_grades","quiz",$quiz,"id");
+        $quiz_grades = $DB->get_records('quiz_grades',array('quiz' => $quiz),'id');
         //If there are grades
         if ($quiz_grades) {
             //Write start tag
@@ -427,9 +438,10 @@
 
     //Backup quiz_attempts contents (executed from quiz_backup_mods)
     function backup_quiz_attempts ($bf,$preferences,$quiz) {
+        global $DB;
         $status = true;
 
-        $quiz_attempts = get_records("quiz_attempts","quiz",$quiz,"id");
+        $quiz_attempts = $DB->get_records('quiz_attempts', array('quiz' => $quiz),'id');
         //If there are attempts
         if ($quiz_attempts) {
             //Write start tag
@@ -574,31 +586,31 @@
     //Returns an array of quiz id
     function quiz_ids ($course) {
 
-        global $CFG;
+        global $CFG, $DB;
 
-        return get_records_sql ("SELECT a.id, a.course
-                                 FROM {$CFG->prefix}quiz a
-                                 WHERE a.course = '$course'");
+        return $DB->get_records_sql ("SELECT a.id, a.course
+                                     FROM {quiz} a
+                                     WHERE a.course = ?", array($course));
     }
 
     function quiz_grade_ids_by_course ($course) {
 
-        global $CFG;
+        global $CFG, $DB;
 
-        return get_records_sql ("SELECT g.id, g.quiz
-                                 FROM {$CFG->prefix}quiz a,
-                                      {$CFG->prefix}quiz_grades g
-                                 WHERE a.course = '$course' and
-                                       g.quiz = a.id");
+        return $DB->get_records_sql ("SELECT g.id, g.quiz
+                                     FROM {quiz} a,
+                                          {quiz_grades} g
+                                     WHERE a.course = ? and
+                                           g.quiz = a.id", array($course));
     }
 
     function quiz_grade_ids_by_instance($instanceid) {
 
-        global $CFG;
+        global $CFG, $DB;
 
-        return get_records_sql ("SELECT g.id, g.quiz
-                                 FROM {$CFG->prefix}quiz_grades g
-                                 WHERE g.quiz = $instanceid");
+        return $DB->get_records_sql ("SELECT g.id, g.quiz
+                                     FROM {quiz_grades} g
+                                     WHERE g.quiz = ?", array($instanceid));
     }
 
 ?>
diff --git a/mod/quiz/comment.php b/mod/quiz/comment.php
index 29b8ae4eda..535995d610 100644
--- a/mod/quiz/comment.php
+++ b/mod/quiz/comment.php
@@ -12,13 +12,13 @@
     $attemptid =required_param('attempt', PARAM_INT); // attempt id
     $questionid =required_param('question', PARAM_INT); // question id
 
-    if (! $attempt = get_record('quiz_attempts', 'uniqueid', $attemptid)) {
+    if (! $attempt = $DB->get_record('quiz_attempts', array('uniqueid' => $attemptid))) {
         print_error('No such attempt ID exists');
     }
-    if (! $quiz = get_record('quiz', 'id', $attempt->quiz)) {
+    if (! $quiz = $DB->get_record('quiz', array('id' => $attempt->quiz))) {
         print_error('Course module is incorrect');
     }
-    if (! $course = get_record('course', 'id', $quiz->course)) {
+    if (! $course = $DB->get_record('course', array('id' => $quiz->course))) {
         print_error('Course is misconfigured');
     }
 
@@ -35,10 +35,10 @@
     require_capability('mod/quiz:grade', $context);
 
     // Load question
-    if (! $question = get_record('question', 'id', $questionid)) {
+    if (! $question = $DB->get_record('question', array('id' => $questionid))) {
         print_error('Question for this session is missing');
     }
-    $question->maxgrade = get_field('quiz_question_instances', 'grade', 'quiz', $quiz->id, 'question', $question->id);
+    $question->maxgrade = $DB->get_field('quiz_question_instances', 'grade', array('quiz' => $quiz->id, 'question' => $question->id));
     // Some of the questions code is optimised to work with several questions
     // at once so it wants the question to be in an array.
     $key = $question->id;
diff --git a/mod/quiz/edit.php b/mod/quiz/edit.php
index 3adf409d7f..247d2ddae9 100644
--- a/mod/quiz/edit.php
+++ b/mod/quiz/edit.php
@@ -36,11 +36,11 @@
         global $CFG;
         if ($canuse){
 			// for RTL languages: switch right and left arrows /****/
-			if (right_to_left()) { 
-				$movearrow = 'removeright.gif'; 
-			} else { 
-				$movearrow = 'moveleft.gif'; 
-			} 
+			if (right_to_left()) {
+				$movearrow = 'removeright.gif';
+			} else {
+				$movearrow = 'moveleft.gif';
+			}
             $straddtoquiz = get_string("addtoquiz", "quiz");
             $out = "<a title=\"$straddtoquiz\" href=\"edit.php?".$pageurl->get_query_string()."&amp;addquestion=$questionid&amp;sesskey=".sesskey()."\"><img
                   src=\"$CFG->pixpath/t/$movearrow\" alt=\"$straddtoquiz\" /></a>&nbsp;";
@@ -106,7 +106,7 @@
     $streditingquiz = get_string('editinga', 'moodle', $strquiz);
 
     // Get the course object and related bits.
-    if (! $course = get_record("course", "id", $quiz->course)) {
+    if (! $course = $DB->get_record('course', array('id' => $quiz->course))) {
         error("This course doesn't exist");
     }
 
@@ -140,7 +140,7 @@
             $quiz->questions = $quiz->questions . ',0';
             // Avoid duplicate page breaks
             $quiz->questions = str_replace(',0,0', ',0', $quiz->questions);
-            if (!set_field('quiz', 'questions', $quiz->questions, 'id', $quiz->instance)) {
+            if (!$DB->set_field('quiz', 'questions', $quiz->questions, array('id' => $quiz->instance))) {
                 error('Could not save question list');
             }
             $significantchangemade = true;
@@ -157,7 +157,7 @@
             $quiz->questions = implode(",", $questions);
             // Avoid duplicate page breaks
             $quiz->questions = str_replace(',0,0', ',0', $quiz->questions);
-            if (!set_field('quiz', 'questions', $quiz->questions, 'id', $quiz->instance)) {
+            if (!$DB->set_field('quiz', 'questions', $quiz->questions, array('id' => $quiz->instance))) {
                 error('Could not save question list');
             }
             $significantchangemade = true;
@@ -185,20 +185,20 @@
         $categoryid = required_param('categoryid', PARAM_INT);
         $randomcount = required_param('randomcount', PARAM_INT);
         // load category
-        if (! $category = get_record('question_categories', 'id', $categoryid)) {
+        if (! $category = $DB->get_record('question_categories', array('id' => $categoryid))) {
             error('Category ID is incorrect');
         }
         $catcontext = get_context_instance_by_id($category->contextid);
         require_capability('moodle/question:useall', $catcontext);
-        $category->name = addslashes($category->name);
+        $category->name = $category->name;
         // Find existing random questions in this category that are not used by any quiz.
-        if ($existingquestions = get_records_sql(
-                "SELECT * FROM " . $CFG->prefix . "question q
+        if ($existingquestions = $DB->get_records_sql(
+                "SELECT * FROM {question} q
                 WHERE qtype = '" . RANDOM . "'
-                    AND category = $category->id
-                    AND " . sql_compare_text('questiontext') . " = '$recurse'
-                    AND NOT EXISTS (SELECT * FROM " . $CFG->prefix . "quiz_question_instances WHERE question = q.id)
-                ORDER BY id")) {
+                    AND category = ?
+                    AND " . sql_compare_text('questiontext') . " = ?
+                    AND NOT EXISTS (SELECT * FROM {quiz_question_instances} WHERE question = q.id)
+                ORDER BY id", array($category->id, $recurse))) {
             // Take as many of these as needed.
             while (($existingquestion = array_shift($existingquestions)) and $randomcount > 0) {
                 quiz_add_quiz_question($existingquestion->id, $quiz);
@@ -233,12 +233,12 @@
         $questionsperpage = optional_param('questionsperpage', $quiz->questionsperpage, PARAM_INT);
         if ($questionsperpage != $quiz->questionsperpage) {
             $quiz->questionsperpage = $questionsperpage;
-            if (!set_field('quiz', 'questionsperpage', $quiz->questionsperpage, 'id', $quiz->id)) {
+            if (!$DB->set_field('quiz', 'questionsperpage', $quiz->questionsperpage, array('id' => $quiz->id))) {
                 error('Could not save number of questions per page');
             }
         }
         $quiz->questions = quiz_repaginate($quiz->questions, $quiz->questionsperpage);
-        if (!set_field('quiz', 'questions', $quiz->questions, 'id', $quiz->id)) {
+        if (!$DB->set_field('quiz', 'questions', $quiz->questions, array('id' => $quiz->id))) {
             error('Could not save layout');
         }
         $significantchangemade = true;
@@ -287,7 +287,7 @@
             while (strpos($quiz->questions, ',0,0')) {
                 $quiz->questions = str_replace(',0,0', ',0', $quiz->questions);
             }
-            if (!set_field('quiz', 'questions', $quiz->questions, 'id', $quiz->instance)) {
+            if (!$DB->set_field('quiz', 'questions', $quiz->questions, array('id' => $quiz->instance))) {
                 error('Could not save question list');
             }
         }
@@ -304,8 +304,8 @@
 
 /// Delete any teacher preview attempts if the quiz has been modified
     if ($significantchangemade) {
-        $previewattempts = get_records_select('quiz_attempts',
-                'quiz = ' . $quiz->id . ' AND preview = 1');
+        $previewattempts = $DB->get_records_select('quiz_attempts',
+                'quiz = ? AND preview = 1', array($quiz->id));
         if ($previewattempts) {
             foreach ($previewattempts as $attempt) {
                 quiz_delete_attempt($attempt, $quiz);
@@ -318,7 +318,7 @@
 /// all commands have been dealt with, now print the page
 
     // Print basic page layout.
-    if (isset($quiz->instance) and record_exists_select('quiz_attempts', "quiz = '$quiz->instance' AND preview = '0'")){
+    if (isset($quiz->instance) and $DB->record_exists_select('quiz_attempts', "quiz = ? AND preview = '0'", array($quiz->instance))){
         // one column layout with table of questions used in this quiz
         $strupdatemodule = has_capability('moodle/course:manageactivities', $contexts->lowest())
                     ? update_module_button($cm->id, $course->id, get_string('modulename', 'quiz'))
@@ -341,7 +341,7 @@
         echo "</div>\n";
 
         $sumgrades = quiz_print_question_list($quiz,  $thispageurl, false, $quiz_showbreaks, $quiz_reordertool);
-        if (!set_field('quiz', 'sumgrades', $sumgrades, 'id', $quiz->instance)) {
+        if (!$DB->set_field('quiz', 'sumgrades', $sumgrades, array('id' => $quiz->instance))) {
             error('Failed to set sumgrades');
         }
 
@@ -368,7 +368,7 @@
     print_heading(get_string('questionsinthisquiz', 'quiz'), '', 2);
 
     $sumgrades = quiz_print_question_list($quiz, $thispageurl, true, $quiz_showbreaks, $quiz_reordertool);
-    if (!set_field('quiz', 'sumgrades', $sumgrades, 'id', $quiz->instance)) {
+    if (!$DB->set_field('quiz', 'sumgrades', $sumgrades, array('id' => $quiz->instance))) {
         error('Failed to set sumgrades');
     }
 
diff --git a/mod/quiz/editlib.php b/mod/quiz/editlib.php
index 5c47077b58..22812863da 100644
--- a/mod/quiz/editlib.php
+++ b/mod/quiz/editlib.php
@@ -22,6 +22,7 @@ require_once("locallib.php");
 *                         This is updated by this function
 */
 function quiz_delete_quiz_question($id, &$quiz) {
+    global $DB;
     // TODO: For the sake of safety check that this question can be deleted
     // safely, i.e., that it is not already in use.
     $questions = explode(",", $quiz->questions);
@@ -42,10 +43,10 @@ function quiz_delete_quiz_question($id, &$quiz) {
     // Avoid duplicate page breaks
     $quiz->questions = str_replace(',0,0', ',0', $quiz->questions);
     // save new questionlist in database
-    if (!set_field('quiz', 'questions', $quiz->questions, 'id', $quiz->instance)) {
+    if (!$DB->set_field('quiz', 'questions', $quiz->questions, array('id' => $quiz->instance))) {
         print_error('Could not save question list');
     }
-    delete_records('quiz_question_instances', 'quiz', $quiz->instance, 'question', $question);
+    $DB->delete_records('quiz_question_instances', array('quiz' => $quiz->instance, 'question', $question));
     return true;
 }
 
@@ -62,6 +63,7 @@ function quiz_delete_quiz_question($id, &$quiz) {
 *                         This is updated by this function
 */
 function quiz_add_quiz_question($id, &$quiz) {
+    global $DB;
     $questions = explode(",", $quiz->questions);
 
     if (in_array($id, $questions)) {
@@ -85,12 +87,12 @@ function quiz_add_quiz_question($id, &$quiz) {
 
     // Save new questionslist in database
     $quiz->questions = implode(",", $questions);
-    if (!set_field('quiz', 'questions', $quiz->questions, 'id', $quiz->id)) {
+    if (!$DB->set_field('quiz', 'questions', $quiz->questions, array('id' => $quiz->id))) {
         print_error('Could not save question list');
     }
 
     // update question grades
-    $questionrecord = get_record("question", "id", $id);
+    $questionrecord = $DB->get_record('question', array('id' => $id));
     $quiz->grades[$id]
             = $questionrecord->defaultgrade;
     quiz_update_question_instance($quiz->grades[$id], $id, $quiz->instance);
@@ -109,15 +111,16 @@ function quiz_add_quiz_question($id, &$quiz) {
 * @param integer $quizid  The id of the quiz to update / add the instances for.
 */
 function quiz_update_question_instance($grade, $questionid, $quizid) {
-    if ($instance = get_record("quiz_question_instances", "quiz", $quizid, 'question', $questionid)) {
+    global $DB;
+    if ($instance = $DB->get_record('quiz_question_instances', array('quiz' => $quizid, 'question' => $questionid))) {
         $instance->grade = $grade;
-        return update_record('quiz_question_instances', $instance);
+        return $DB->update_record('quiz_question_instances', $instance);
     } else {
         unset($instance);
         $instance->quiz = $quizid;
         $instance->question = $questionid;
         $instance->grade = $grade;
-        return insert_record("quiz_question_instances", $instance);
+        return $DB->insert_record("quiz_question_instances", $instance);
     }
 }
 
@@ -133,7 +136,7 @@ function quiz_update_question_instance($grade, $questionid, $quizid) {
 * @param boolean $showbreaks  Indicates whether the reorder tool should be displayed
 */
 function quiz_print_question_list($quiz, $pageurl, $allowdelete=true, $showbreaks=true, $reordertool=false) {
-    global $USER, $CFG, $QTYPES;
+    global $USER, $CFG, $QTYPES, $DB;
 
     $strorder = get_string("order");
     $strquestionname = get_string("questionname", "quiz");
@@ -155,11 +158,12 @@ function quiz_print_question_list($quiz, $pageurl, $allowdelete=true, $showbreak
         return 0;
     }
 
-    if (!$questions = get_records_sql("SELECT q.*,c.contextid
-                              FROM {$CFG->prefix}question q,
-                                   {$CFG->prefix}question_categories c
-                             WHERE q.id in ($quiz->questions)
-                               AND q.category = c.id")) {
+    list($usql, $params) = $DB->get_in_or_equal(explode(',', $quiz->questions));
+    if (!$questions = $DB->get_records_sql("SELECT q.*,c.contextid
+                              FROM {question} q,
+                                   {question_categories} c
+                             WHERE q.id $usql
+                               AND q.category = c.id", $params)) {
         echo "<p class=\"quizquestionlistcontrols\">";
         print_string("noquestions", "quiz");
         echo "</p>";
@@ -191,11 +195,11 @@ function quiz_print_question_list($quiz, $pageurl, $allowdelete=true, $showbreak
     echo "</tr>\n";
 
 	// for RTL languages: switch right and left arrows /****/
-    if (right_to_left()) { 
-        $movearrow = 'moveleft.gif'; 
-    } else { 
-        $movearrow = 'removeright.gif'; 
-    } 
+    if (right_to_left()) {
+        $movearrow = 'moveleft.gif';
+    } else {
+        $movearrow = 'removeright.gif';
+    }
 
     foreach ($order as $i => $qnum) {
 
diff --git a/mod/quiz/grade.php b/mod/quiz/grade.php
index dcbe491755..e2751a1f98 100644
--- a/mod/quiz/grade.php
+++ b/mod/quiz/grade.php
@@ -8,11 +8,11 @@
         print_error('Course Module ID was incorrect');
     }
 
-    if (! $quiz = get_record('quiz', 'id', $cm->instance)) {
+    if (! $quiz = $DB->get_record('quiz', array('id' => $cm->instance))) {
         print_error('quiz ID was incorrect');
     }
 
-    if (! $course = get_record('course', 'id', $quiz->course)) {
+    if (! $course = $DB->get_record('course', array('id' => $quiz->course))) {
         print_error('Course is misconfigured');
     }
 
diff --git a/mod/quiz/index.php b/mod/quiz/index.php
index d01b712f53..7bafe05f1f 100644
--- a/mod/quiz/index.php
+++ b/mod/quiz/index.php
@@ -10,7 +10,7 @@
     require_once("locallib.php");
 
     $id = required_param('id', PARAM_INT);
-    if (!$course = get_record("course", "id", $id)) {
+    if (!$course = $DB->get_record('course', array('id' => $id))) {
         print_error("Course ID is incorrect");
     }
     $coursecontext = get_context_instance(CONTEXT_COURSE, $id);
diff --git a/mod/quiz/lib.php b/mod/quiz/lib.php
index e9db294e6d..11b8770448 100644
--- a/mod/quiz/lib.php
+++ b/mod/quiz/lib.php
@@ -116,7 +116,7 @@ function quiz_update_instance($quiz) {
     quiz_after_add_or_update($quiz);
 
     // Delete any previous preview attempts
-    $DB->delete_records('quiz_attempts', 'preview', '1', array('quiz'=>$quiz->id));
+    $DB->delete_records('quiz_attempts', array('preview' => '1', 'quiz'=>$quiz->id));
 
     return true;
 }
@@ -180,12 +180,13 @@ function quiz_delete_instance($id) {
 
 
 function quiz_user_outline($course, $user, $mod, $quiz) {
+    global $DB;
 /// Return a small object with summary information about what a
 /// user has done with a given particular instance of this module
 /// Used for user activity reports.
 /// $return->time = the time they did it
 /// $return->info = a short text description
-    if ($grade = get_record('quiz_grades', 'userid', $user->id, 'quiz', $quiz->id)) {
+    if ($grade = $DB->get_record('quiz_grades', array('userid' => $user->id, 'quiz' => $quiz->id))) {
 
         $result = new stdClass;
         if ((float)$grade->grade) {
@@ -200,11 +201,12 @@ function quiz_user_outline($course, $user, $mod, $quiz) {
 
 
 function quiz_user_complete($course, $user, $mod, $quiz) {
+    global $DB;
 /// Print a detailed representation of what a  user has done with
 /// a given particular instance of this module, for user activity reports.
 
-    if ($attempts = get_records_select('quiz_attempts', "userid='$user->id' AND quiz='$quiz->id'", 'attempt ASC')) {
-        if ($quiz->grade  and $quiz->sumgrades && $grade = get_record('quiz_grades', 'userid', $user->id, 'quiz', $quiz->id)) {
+    if ($attempts = $DB->get_records_select('quiz_attempts', "userid=? AND quiz=?", 'attempt ASC', array($user->id, $quiz->id))) {
+        if ($quiz->grade  and $quiz->sumgrades && $grade = $DB->get_record('quiz_grades', array('userid' => $user->id, 'quiz' => $quiz->id))) {
             echo get_string('grade').': '.round($grade->grade, $quiz->decimalpoints).'/'.$quiz->grade.'<br />';
         }
         foreach ($attempts as $attempt) {
@@ -241,6 +243,7 @@ function quiz_cron () {
  * @return an array of all the user's attempts at this quiz. Returns an empty array if there are none.
  */
 function quiz_get_user_attempts($quizid, $userid, $status = 'finished', $includepreviews = false) {
+    global $DB;
     $status_condition = array(
         'all' => '',
         'finished' => ' AND timefinish > 0',
@@ -250,8 +253,8 @@ function quiz_get_user_attempts($quizid, $userid, $status = 'finished', $include
     if (!$includepreviews) {
         $previewclause = ' AND preview = 0';
     }
-    if ($attempts = get_records_select('quiz_attempts',
-            "quiz = '$quizid' AND userid = '$userid'" . $previewclause . $status_condition[$status],
+    if ($attempts = $DB->get_records_select('quiz_attempts',
+            "quiz = ? AND userid = ?" . $previewclause . $status_condition[$status], array($quizid, $userid),
             'attempt ASC')) {
         return $attempts;
     } else {
@@ -267,17 +270,20 @@ function quiz_get_user_attempts($quizid, $userid, $status = 'finished', $include
  * @return array array of grades, false if none
  */
 function quiz_get_user_grades($quiz, $userid=0) {
-    global $CFG;
-
-    $user = $userid ? "AND u.id = $userid" : "";
+    global $CFG, $DB;
 
+    $params = array($quiz->id);
+    $wheresql = '';
+    if ($userid) {
+        $params[] = $userid;
+        $wheresql = "AND u.id = ?";
+    }
     $sql = "SELECT u.id, u.id AS userid, g.grade AS rawgrade, g.timemodified AS dategraded, MAX(a.timefinish) AS datesubmitted
-            FROM {$CFG->prefix}user u, {$CFG->prefix}quiz_grades g, {$CFG->prefix}quiz_attempts a
-            WHERE u.id = g.userid AND g.quiz = {$quiz->id} AND a.quiz = g.quiz AND u.id = a.userid
-                  $user
+            FROM {user} u, {quiz_grades} g, {quiz_attempts} a
+            WHERE u.id = g.userid AND g.quiz = ? AND a.quiz = g.quiz AND u.id = a.userid $wheresql
             GROUP BY u.id, g.grade, g.timemodified";
 
-    return get_records_sql($sql);
+    return $DB->get_records_sql($sql, $params);
 }
 
 /**
@@ -287,7 +293,7 @@ function quiz_get_user_grades($quiz, $userid=0) {
  * @param int $userid specific user only, 0 mean all
  */
 function quiz_update_grades($quiz=null, $userid=0, $nullifnone=true) {
-    global $CFG;
+    global $CFG, $DB;
     if (!function_exists('grade_update')) { //workaround for buggy PHP versions
         require_once($CFG->libdir.'/gradelib.php');
     }
@@ -308,17 +314,17 @@ function quiz_update_grades($quiz=null, $userid=0, $nullifnone=true) {
 
     } else {
         $sql = "SELECT a.*, cm.idnumber as cmidnumber, a.course as courseid
-                  FROM {$CFG->prefix}quiz a, {$CFG->prefix}course_modules cm, {$CFG->prefix}modules m
+                  FROM {quiz} a, {course_modules} cm, {modules} m
                  WHERE m.name='quiz' AND m.id=cm.module AND cm.instance=a.id";
-        if ($rs = get_recordset_sql($sql)) {
-            while ($quiz = rs_fetch_next_record($rs)) {
+        if ($rs = $DB->get_recordset_sql($sql)) {
+            foreach ($rs as $quiz) {
                 if ($quiz->grade != 0) {
                     quiz_update_grades($quiz, 0, false);
                 } else {
                     quiz_grade_item_update($quiz);
                 }
             }
-            rs_close($rs);
+            $rs->close();
         }
     }
 }
@@ -379,7 +385,7 @@ function quiz_grade_item_update($quiz, $grades=NULL) {
         $params['reset'] = true;
         $grades = NULL;
     }
-    
+
     $gradebook_grades = grade_get_grades($quiz->course, 'mod', 'quiz', $quiz->id);
     if (!empty($gradebook_grades->items)) {
         $grade_item = $gradebook_grades->items[0];
@@ -396,7 +402,7 @@ function quiz_grade_item_update($quiz, $grades=NULL) {
                 print_single_button($back_link,  null,  get_string('cancel'),  'post',  $CFG->framename);
                 echo '</div>';
                 print_box_end();
-    
+
                 return GRADE_UPDATE_ITEM_LOCKED;
             }
         }
@@ -423,21 +429,21 @@ function quiz_get_participants($quizid) {
 /// Returns an array of users who have data in a given quiz
 /// (users with records in quiz_attempts and quiz_question_versions)
 
-    global $CFG;
+    global $CFG, $DB;
 
     //Get users from attempts
-    $us_attempts = get_records_sql("SELECT DISTINCT u.id, u.id
-                                    FROM {$CFG->prefix}user u,
-                                         {$CFG->prefix}quiz_attempts a
-                                    WHERE a.quiz = '$quizid' and
-                                          u.id = a.userid");
+    $us_attempts = $DB->get_records_sql("SELECT DISTINCT u.id, u.id
+                                    FROM {user} u,
+                                         {quiz_attempts} a
+                                    WHERE a.quiz = ? and
+                                          u.id = a.userid", array($quizid));
 
     //Get users from question_versions
-    $us_versions = get_records_sql("SELECT DISTINCT u.id, u.id
-                                    FROM {$CFG->prefix}user u,
-                                         {$CFG->prefix}quiz_question_versions v
-                                    WHERE v.quiz = '$quizid' and
-                                          u.id = v.userid");
+    $us_versions = $DB->get_records_sql("SELECT DISTINCT u.id, u.id
+                                    FROM {user} u,
+                                         {quiz_question_versions} v
+                                    WHERE v.quiz = ? and
+                                          u.id = v.userid", array($quizid));
 
     //Add us_versions to us_attempts
     if ($us_versions) {
@@ -451,6 +457,7 @@ function quiz_get_participants($quizid) {
 }
 
 function quiz_refresh_events($courseid = 0) {
+    global $DB;
 // This horrible function only seems to be called from mod/quiz/db/[dbtype].php.
 
 // This standard function will check all instances of this module
@@ -460,28 +467,28 @@ function quiz_refresh_events($courseid = 0) {
 // This function is used, in its new format, by restore_refresh_events()
 
     if ($courseid == 0) {
-        if (! $quizzes = get_records("quiz")) {
+        if (! $quizzes = $DB->get_records('quiz')) {
             return true;
         }
     } else {
-        if (! $quizzes = get_records("quiz", "course", $courseid)) {
+        if (! $quizzes = $DB->get_records('quiz', array('course' => $courseid))) {
             return true;
         }
     }
-    $moduleid = get_field('modules', 'id', 'name', 'quiz');
+    $moduleid = $DB->get_field('modules', 'id', array('name' => 'quiz'));
 
     foreach ($quizzes as $quiz) {
         $event = NULL;
         $event2 = NULL;
         $event2old = NULL;
 
-        if ($events = get_records_select('event', "modulename = 'quiz' AND instance = '$quiz->id' ORDER BY timestart")) {
+        if ($events = $DB->get_records_select('event', "modulename = 'quiz' AND instance = ? ORDER BY timestart", array($quiz->id))) {
             $event = array_shift($events);
             if (!empty($events)) {
                 $event2old = array_shift($events);
                 if (!empty($events)) {
                     foreach ($events as $badevent) {
-                        delete_records('event', 'id', $badevent->id);
+                        $DB->delete_records('event', array('id' => $badevent->id));
                     }
                 }
             }
@@ -538,41 +545,45 @@ function quiz_refresh_events($courseid = 0) {
  * Returns all quiz graded users since a given time for specified quiz
  */
 function quiz_get_recent_mod_activity(&$activities, &$index, $timestart, $courseid, $cmid, $userid=0, $groupid=0)  {
-    global $CFG, $COURSE, $USER;
+    global $CFG, $COURSE, $USER, $DB;
 
     if ($COURSE->id == $courseid) {
         $course = $COURSE;
     } else {
-        $course = get_record('course', 'id', $courseid);
+        $course = $DB->get_record('course', array('id' => $courseid));
     }
 
     $modinfo =& get_fast_modinfo($course);
 
     $cm = $modinfo->cms[$cmid];
 
+    $params = array($timestart, $cm->instance);
+
     if ($userid) {
-        $userselect = "AND u.id = $userid";
+        $userselect = "AND u.id = ?";
+        $params[] = $userid;
     } else {
         $userselect = "";
     }
 
     if ($groupid) {
-        $groupselect = "AND gm.groupid = $groupid";
-        $groupjoin   = "JOIN {$CFG->prefix}groups_members gm ON  gm.userid=u.id";
+        $groupselect = "AND gm.groupid = ?";
+        $groupjoin   = "JOIN {groups_members} gm ON  gm.userid=u.id";
+        $params[] = $groupid;
     } else {
         $groupselect = "";
         $groupjoin   = "";
     }
 
-    if (!$attempts = get_records_sql("SELECT qa.*, q.sumgrades AS maxgrade,
-                                             u.firstname, u.lastname, u.email, u.picture 
-                                        FROM {$CFG->prefix}quiz_attempts qa
-                                             JOIN {$CFG->prefix}quiz q ON q.id = qa.quiz
-                                             JOIN {$CFG->prefix}user u ON u.id = qa.userid
+    if (!$attempts = $DB->get_records_sql("SELECT qa.*, q.sumgrades AS maxgrade,
+                                             u.firstname, u.lastname, u.email, u.picture
+                                        FROM {quiz_attempts} qa
+                                             JOIN {quiz} q ON q.id = qa.quiz
+                                             JOIN {user} u ON u.id = qa.userid
                                              $groupjoin
                                        WHERE qa.timefinish > $timestart AND q.id = $cm->instance
                                              $userselect $groupselect
-                                    ORDER BY qa.timefinish ASC")) {
+                                    ORDER BY qa.timefinish ASC", $params)) {
          return;
     }
 
@@ -596,7 +607,7 @@ function quiz_get_recent_mod_activity(&$activities, &$index, $timestart, $course
                 continue;
             }
 
-            if ($groupmode == SEPARATEGROUPS and !$accessallgroups) { 
+            if ($groupmode == SEPARATEGROUPS and !$accessallgroups) {
                 $usersgroups = groups_get_all_groups($course->id, $attempt->userid, $cm->groupingid);
                 if (!is_array($usersgroups)) {
                     continue;
@@ -616,16 +627,16 @@ function quiz_get_recent_mod_activity(&$activities, &$index, $timestart, $course
         $tmpactivity->name      = $aname;
         $tmpactivity->sectionnum= $cm->sectionnum;
         $tmpactivity->timestamp = $attempt->timefinish;
-        
+
         $tmpactivity->content->attemptid = $attempt->id;
         $tmpactivity->content->sumgrades = $attempt->sumgrades;
         $tmpactivity->content->maxgrade  = $attempt->maxgrade;
         $tmpactivity->content->attempt   = $attempt->attempt;
-        
+
         $tmpactivity->user->userid   = $attempt->userid;
         $tmpactivity->user->fullname = fullname($attempt, $viewfullnames);
         $tmpactivity->user->picture  = $attempt->picture;
-        
+
         $activities[$index++] = $tmpactivity;
     }
 
@@ -974,13 +985,13 @@ function quiz_reset_course_form_defaults($course) {
  * @param string optional type
  */
 function quiz_reset_gradebook($courseid, $type='') {
-    global $CFG;
+    global $CFG, $DB;
 
     $sql = "SELECT q.*, cm.idnumber as cmidnumber, q.course as courseid
-              FROM {$CFG->prefix}quiz q, {$CFG->prefix}course_modules cm, {$CFG->prefix}modules m
-             WHERE m.name='quiz' AND m.id=cm.module AND cm.instance=q.id AND q.course=$courseid";
+              FROM {quiz} q, {course_modules} cm, {modules} m
+             WHERE m.name='quiz' AND m.id=cm.module AND cm.instance=q.id AND q.course=?";
 
-    if ($quizs = get_records_sql($sql)) {
+    if ($quizs = $DB->get_records_sql($sql, array($courseid))) {
         foreach ($quizs as $quiz) {
             quiz_grade_item_update($quiz, 'reset');
         }
@@ -997,29 +1008,29 @@ function quiz_reset_gradebook($courseid, $type='') {
  * @return array status array
  */
 function quiz_reset_userdata($data) {
-    global $CFG, $QTYPES;
+    global $CFG, $QTYPES, $DB;
 
     $componentstr = get_string('modulenameplural', 'quiz');
     $status = array();
 
     /// Delete attempts.
     if (!empty($data->reset_quiz_attempts)) {
-
+        $params = array($data->courseid);
         $stateslistsql = "SELECT s.id
-                            FROM {$CFG->prefix}question_states s
-                                 INNER JOIN {$CFG->prefix}quiz_attempts qza ON s.attempt=qza.uniqueid
-                                 INNER JOIN {$CFG->prefix}quiz q ON qza.quiz=q.id
-                           WHERE q.course={$data->courseid}";
+                            FROM {question_states} s
+                                 INNER JOIN {quiz_attempts} qza ON s.attempt=qza.uniqueid
+                                 INNER JOIN {quiz} q ON qza.quiz=q.id
+                           WHERE q.course=?";
 
         $attemptssql   = "SELECT a.uniqueid
-                            FROM {$CFG->prefix}quiz_attempts a, {$CFG->prefix}quiz q
-                           WHERE q.course={$data->courseid} AND a.quiz=q.id";
+                            FROM {quiz_attempts} a, {quiz} q
+                           WHERE q.course=? AND a.quiz=q.id";
 
         $quizessql     = "SELECT q.id
-                            FROM {$CFG->prefix}quiz q
-                           WHERE q.course={$data->courseid}";
+                            FROM {quiz} q
+                           WHERE q.course=?";
 
-        if ($states = get_records_sql($stateslistsql)) {
+        if ($states = $DB->get_records_sql($stateslistsql, $params)) {
             //TODO: not sure if this works
             $stateslist = implode(',', array_keys($states));
             foreach ($QTYPES as $qtype) {
@@ -1027,19 +1038,19 @@ function quiz_reset_userdata($data) {
             }
         }
 
-        delete_records_select('question_states', "attempt IN ($attemptssql)");
-        delete_records_select('question_sessions', "attemptid IN ($attemptssql)");
-        delete_records_select('question_attempts', "id IN ($attemptssql)");
+        $DB->delete_records_select('question_states', "attempt IN ($attemptssql)", $params);
+        $DB->delete_records_select('question_sessions', "attemptid IN ($attemptssql)", $params);
+        $DB->delete_records_select('question_attempts', "id IN ($attemptssql)", $params);
 
         // remove all grades from gradebook
         if (empty($data->reset_gradebook_grades)) {
             quiz_reset_gradebook($data->courseid);
         }
 
-        delete_records_select('quiz_grades', "quiz IN ($quizessql)");
+        $DB->delete_records_select('quiz_grades', "quiz IN ($quizessql)", $params);
         $status[] = array('component'=>$componentstr, 'item'=>get_string('gradesdeleted','quiz'), 'error'=>false);
 
-        delete_records_select('quiz_attempts', "quiz IN ($quizessql)");
+        $DB->delete_records_select('quiz_attempts', "quiz IN ($quizessql)", $params);
         $status[] = array('component'=>$componentstr, 'item'=>get_string('attemptsdeleted','quiz'), 'error'=>false);
     }
 
@@ -1061,10 +1072,10 @@ function quiz_reset_userdata($data) {
  * @return boolean to indicate access granted or denied
  */
 function quiz_check_file_access($attemptuniqueid, $questionid) {
-    global $USER;
+    global $USER, $DB;
 
-    $attempt = get_record("quiz_attempts", 'uniqueid', $attemptid);
-    $quiz = get_record("quiz", 'id', $attempt->quiz);
+    $attempt = $DB->get_record('quiz_attempts', array('uniqueid' => $attemptid));
+    $quiz = $DB->get_record('quiz', array('id' => $attempt->quiz));
     $context = get_context_instance(CONTEXT_COURSE, $quiz->course);
 
     // access granted if the current user submitted this file
@@ -1113,14 +1124,14 @@ function quiz_print_overview($courses, &$htmlarray) {
             $context = get_context_instance(CONTEXT_MODULE, $quiz->coursemodule);
             if (has_capability('mod/quiz:viewreports', $context)) {
             /// For teacher-like people, show a summary of the number of student attempts.
-                // The $quiz objects returned by get_all_instances_in_course have the necessary $cm 
+                // The $quiz objects returned by get_all_instances_in_course have the necessary $cm
                 // fields set to make the following call work.
                 $str .= '<div class="info">' . quiz_num_attempt_summary($quiz, $quiz, true) . '</div>';
             } else if (has_capability('mod/quiz:attempt', $context)){ // Student
             /// For student-like people, tell them how many attempts they have made.
                 if (isset($USER->id) && ($attempts = quiz_get_user_attempts($quiz->id, $USER->id))) {
                     $numattempts = count($attempts);
-                    $str .= '<div class="info">' . get_string('numattemptsmade', 'quiz', $numattempts) . '</div>';  
+                    $str .= '<div class="info">' . get_string('numattemptsmade', 'quiz', $numattempts) . '</div>';
                 } else {
                     $str .= '<div class="info">' . $strnoattempts . '</div>';
                 }
@@ -1152,23 +1163,24 @@ function quiz_print_overview($courses, &$htmlarray) {
  *          "Attemtps 123 (45 from this group)".
  */
 function quiz_num_attempt_summary($quiz, $cm, $returnzero = false, $currentgroup = 0) {
-    global $CFG, $USER;
-    $numattempts = count_records('quiz_attempts', 'quiz', $quiz->id, 'preview', 0);
+    global $CFG, $USER, $DB;
+    $numattempts = $DB->count_records('quiz_attempts', array('quiz'=> $quiz->id, 'preview'=>0));
     if ($numattempts || $returnzero) {
         if (groups_get_activity_groupmode($cm)) {
             $a->total = $numattempts;
             if ($currentgroup) {
-                $a->group = count_records_sql('SELECT count(1) FROM ' .
-                        $CFG->prefix . 'quiz_attempts qa JOIN ' .
-                        $CFG->prefix . 'groups_members gm ON qa.userid = gm.userid ' .
-                        'WHERE quiz = ' . $quiz->id . ' AND preview = 0 AND groupid = ' . $currentgroup);
+                $a->group = $DB->count_records_sql('SELECT count(1) FROM ' .
+                        '{quiz_attempts} qa JOIN ' .
+                        '{groups_members} gm ON qa.userid = gm.userid ' .
+                        'WHERE quiz = ? AND preview = 0 AND groupid = ?', array($quiz->id, $currentgroup));
                 return get_string('attemptsnumthisgroup', 'quiz', $a);
-            } else if ($groups = groups_get_all_groups($cm->course, $USER->id, $cm->groupingid)) { 
-                $a->group = count_records_sql('SELECT count(1) FROM ' .
-                        $CFG->prefix . 'quiz_attempts qa JOIN ' .
-                        $CFG->prefix . 'groups_members gm ON qa.userid = gm.userid ' .
-                        'WHERE quiz = ' . $quiz->id . ' AND preview = 0 AND ' .
-                        'groupid IN (' . implode(',', array_keys($groups)) . ')');
+            } else if ($groups = groups_get_all_groups($cm->course, $USER->id, $cm->groupingid)) {
+                list($usql, $params) = $DB->get_in_or_equal(array_keys($groups));
+                $a->group = $DB->count_records_sql('SELECT count(1) FROM ' .
+                        '{quiz_attempts} qa JOIN ' .
+                        '{groups_members} gm ON qa.userid = gm.userid ' .
+                        'WHERE quiz = ? AND preview = 0 AND ' .
+                        "groupid $usql", array_merge(array($quiz->id), $params));
                 return get_string('attemptsnumyourgroups', 'quiz', $a);
             }
         }
diff --git a/mod/quiz/locallib.php b/mod/quiz/locallib.php
index 9f32c33c2b..5cd9f73890 100644
--- a/mod/quiz/locallib.php
+++ b/mod/quiz/locallib.php
@@ -140,10 +140,9 @@ function quiz_get_user_attempt_unfinished($quizid, $userid) {
  * @return mixed the attempt if there is one, false if not.
  */
 function quiz_get_latest_attempt_by_user($quizid, $userid) {
-    global $CFG;
-    $attempt = get_records_sql('SELECT qa.* FROM ' . $CFG->prefix . 'quiz_attempts qa
-            WHERE qa.quiz=' . $quizid . ' AND qa.userid=' . $userid .
-            ' ORDER BY qa.timestart DESC, qa.id DESC', 0, 1);
+    global $CFG, $DB;
+    $attempt = $DB->get_records_sql('SELECT qa.* FROM {quiz_attempts} qa
+            WHERE qa.quiz=? AND qa.userid= ? ORDER BY qa.timestart DESC, qa.id DESC', array($quizid, $userid), 0, 1);
     if ($attempt) {
         return array_shift($attempt);
     } else {
@@ -159,9 +158,10 @@ function quiz_get_latest_attempt_by_user($quizid, $userid) {
  * @param integer $attemptid the id of the attempt to load.
  */
 function quiz_load_attempt($attemptid) {
-    $attempt = get_record('quiz_attempts', 'id', $attemptid);
+    global $DB;
+    $attempt = $DB->get_record('quiz_attempts', array('id' => $attemptid));
 
-    if (!record_exists('question_sessions', 'attemptid', $attempt->uniqueid)) {
+    if (!$DB->record_exists('question_sessions', array('attemptid' => $attempt->uniqueid))) {
     /// this attempt has not yet been upgraded to the new model
         quiz_upgrade_states($attempt);
     }
@@ -175,8 +175,9 @@ function quiz_load_attempt($attemptid) {
  * @param object $quiz the quiz object.
  */
 function quiz_delete_attempt($attempt, $quiz) {
+    global $DB;
     if (is_numeric($attempt)) {
-        if (!$attempt = get_record('quiz_attempts', 'id', $attempt)) {
+        if (!$attempt = $DB->get_record('quiz_attempts', array('id' => $attempt))) {
             return;
         }
     }
@@ -187,7 +188,7 @@ function quiz_delete_attempt($attempt, $quiz) {
         return;
     }
 
-    delete_records('quiz_attempts', 'id', $attempt->id);
+    $DB->delete_records('quiz_attempts', array('id' => $attempt->id));
     delete_attempt($attempt->uniqueid);
 
     // Search quiz_attempts for other instances by this user.
@@ -195,8 +196,8 @@ function quiz_delete_attempt($attempt, $quiz) {
     // else recalculate best grade
 
     $userid = $attempt->userid;
-    if (!record_exists('quiz_attempts', 'userid', $userid, 'quiz', $quiz->id)) {
-        delete_records('quiz_grades', 'userid', $userid,'quiz', $quiz->id);
+    if (!$DB->record_exists('quiz_attempts', array('userid' => $userid, 'quiz' => $quiz->id))) {
+        $DB->delete_records('quiz_grades', array('userid' => $userid,'quiz' => $quiz->id));
     } else {
         quiz_save_best_grade($quiz, $userid);
     }
@@ -252,12 +253,13 @@ function quiz_number_of_pages($layout) {
 function quiz_first_questionnumber($quizlayout, $pagelayout) {
     // this works by finding all the questions from the quizlayout that
     // come before the current page and then adding up their lengths.
-    global $CFG;
+    global $CFG, $DB;
     $start = strpos($quizlayout, ','.$pagelayout.',')-2;
     if ($start > 0) {
         $prevlist = substr($quizlayout, 0, $start);
-        return get_field_sql("SELECT sum(length)+1 FROM {$CFG->prefix}question
-         WHERE id IN ($prevlist)");
+        list($usql, $params) = $DB->get_in_or_equal(explode(',', $prevlist));
+        return $DB->get_field_sql("SELECT sum(length)+1 FROM {question}
+         WHERE id $usql", $params);
     } else {
         return 1;
     }
@@ -336,18 +338,24 @@ function quiz_print_navigation_panel($page, $pages) {
  * @param integer $quiz The quiz object
  */
 function quiz_get_all_question_grades($quiz) {
-    global $CFG;
+    global $CFG, $DB;
 
     $questionlist = quiz_questions_in_quiz($quiz->questions);
     if (empty($questionlist)) {
         return array();
     }
 
-    $instances = get_records_sql("SELECT question,grade,id
-                            FROM {$CFG->prefix}quiz_question_instances
-                            WHERE quiz = '$quiz->id'" .
-                            (is_null($questionlist) ? '' :
-                            "AND question IN ($questionlist)"));
+    $params = array($quiz->id);
+    $wheresql = '';
+    if (!is_null($questionlist)) {
+        list($usql, $question_params) = $DB->get_in_or_equal(explode(',', $questionlist));
+        $wheresql = " AND question $usql ";
+        $params = array_merge($params, $question_params);
+    }
+
+    $instances = $DB->get_records_sql("SELECT question,grade,id
+                                    FROM {quiz_question_instances}
+                                    WHERE quiz = ? $wheresql", $params);
 
     $list = explode(",", $questionlist);
     $grades = array();
@@ -370,7 +378,8 @@ function quiz_get_all_question_grades($quiz) {
  * @return float the user's current grade for this quiz.
  */
 function quiz_get_best_grade($quiz, $userid) {
-    $grade = get_field('quiz_grades', 'grade', 'quiz', $quiz->id, 'userid', $userid);
+    global $DB;
+    $grade = $DB->get_field('quiz_grades', 'grade', array('quiz' => $quiz->id, 'userid' => $userid));
 
     // Need to detect errors/no result, without catching 0 scores.
     if (is_numeric($grade)) {
@@ -409,8 +418,9 @@ function quiz_rescale_grade($rawgrade, $quiz, $round = true) {
  * @return string the comment that corresponds to this grade (empty string if there is not one.
  */
 function quiz_feedback_for_grade($grade, $quizid) {
-    $feedback = get_field_select('quiz_feedback', 'feedbacktext',
-            "quizid = $quizid AND mingrade <= $grade AND $grade < maxgrade");
+    global $DB;
+    $feedback = $DB->get_field_select('quiz_feedback', 'feedbacktext',
+            "quizid = ? AND mingrade <= ? AND $grade < maxgrade", array($quizid, $grade));
 
     if (empty($feedback)) {
         $feedback = '';
@@ -429,10 +439,11 @@ function quiz_feedback_for_grade($grade, $quizid) {
  * @return boolean Whether this quiz has any non-blank feedback text.
  */
 function quiz_has_feedback($quizid) {
+    global $DB;
     static $cache = array();
     if (!array_key_exists($quizid, $cache)) {
-        $cache[$quizid] = record_exists_select('quiz_feedback',
-                "quizid = $quizid AND " . sql_isnotempty('quiz_feedback', 'feedbacktext', false, true));
+        $cache[$quizid] = $DB->record_exists_select('quiz_feedback',
+                "quizid = ? AND " . sql_isnotempty('quiz_feedback', 'feedbacktext', false, true), array($quizid));
     }
     return $cache[$quizid];
 }
@@ -447,6 +458,7 @@ function quiz_has_feedback($quizid) {
  * @return boolean indicating success or failure.
  */
 function quiz_set_grade($newgrade, &$quiz) {
+    global $DB;
     // This is potentially expensive, so only do it if necessary.
     if (abs($quiz->grade - $newgrade) < 1e-7) {
         // Nothing to do.
@@ -457,7 +469,7 @@ function quiz_set_grade($newgrade, &$quiz) {
     begin_sql();
 
     // Update the quiz table.
-    $success = set_field('quiz', 'grade', $newgrade, 'id', $quiz->instance);
+    $success = $DB->set_field('quiz', 'grade', $newgrade, array('id' => $quiz->instance));
 
     // Rescaling the other data is only possible if the old grade was non-zero.
     if ($quiz->grade > 1e-7) {
@@ -468,18 +480,18 @@ function quiz_set_grade($newgrade, &$quiz) {
 
         // Update the quiz_grades table.
         $timemodified = time();
-        $success = $success && execute_sql("
-                UPDATE {$CFG->prefix}quiz_grades
-                SET grade = $factor * grade, timemodified = $timemodified
-                WHERE quiz = $quiz->id
-        ", false);
+        $success = $success && $DB->execute("
+                UPDATE {quiz_grades}
+                SET grade = ? * grade, timemodified = ?
+                WHERE quiz = ?
+        ", array($factor, $timemodified, $quiz->id));
 
         // Update the quiz_grades table.
-        $success = $success && execute_sql("
-                UPDATE {$CFG->prefix}quiz_feedback
-                SET mingrade = $factor * mingrade, maxgrade = $factor * maxgrade
-                WHERE quizid = $quiz->id
-        ", false);
+        $success = $success && $DB->execute("
+                UPDATE {quiz_feedback}
+                SET mingrade = ? * mingrade, maxgrade = ? * maxgrade
+                WHERE quizid = ?
+        ", array($factor, $factor, $quiz->id));
     }
 
     // update grade item and send all grades to gradebook
@@ -487,9 +499,9 @@ function quiz_set_grade($newgrade, &$quiz) {
     quiz_update_grades($quiz);
 
     if ($success) {
-        return commit_sql();
+        return $DB->commit_sql();
     } else {
-        rollback_sql();
+        $DB->rollback_sql();
         return false;
     }
 }
@@ -502,6 +514,7 @@ function quiz_set_grade($newgrade, &$quiz) {
  * @return boolean Indicates success or failure.
  */
 function quiz_save_best_grade($quiz, $userid = null) {
+    global $DB;
     global $USER;
 
     if (empty($userid)) {
@@ -519,10 +532,10 @@ function quiz_save_best_grade($quiz, $userid = null) {
     $bestgrade = quiz_rescale_grade($bestgrade, $quiz);
 
     // Save the best grade in the database
-    if ($grade = get_record('quiz_grades', 'quiz', $quiz->id, 'userid', $userid)) {
+    if ($grade = $DB->get_record('quiz_grades', array('quiz' => $quiz->id, 'userid' => $userid))) {
         $grade->grade = $bestgrade;
         $grade->timemodified = time();
-        if (!update_record('quiz_grades', $grade)) {
+        if (!$DB->update_record('quiz_grades', $grade)) {
             notify('Could not update best grade');
             return false;
         }
@@ -531,7 +544,7 @@ function quiz_save_best_grade($quiz, $userid = null) {
         $grade->userid = $userid;
         $grade->grade = $bestgrade;
         $grade->timemodified = time();
-        if (!insert_record('quiz_grades', $grade)) {
+        if (!$DB->insert_record('quiz_grades', $grade)) {
             notify('Could not insert new best grade');
             return false;
         }
@@ -668,12 +681,13 @@ function quiz_parse_fieldname($name, $nameprefix='question') {
  * @param object $attempt  The attempt whose states need upgrading
  */
 function quiz_upgrade_states($attempt) {
+    global $DB;
     global $CFG;
     // The old quiz model only allowed a single response per quiz attempt so that there will be
     // only one state record per question for this attempt.
 
     // We set the timestamp of all states to the timemodified field of the attempt.
-    execute_sql("UPDATE {$CFG->prefix}question_states SET timestamp = '$attempt->timemodified' WHERE attempt = '$attempt->uniqueid'", false);
+    $DB->execute("UPDATE {question_states} SET timestamp = ? WHERE attempt = ?", array($attempt->timemodified, $attempt->uniqueid));
 
     // For each state we create an entry in the question_sessions table, with both newest and
     // newgraded pointing to this state.
@@ -683,12 +697,16 @@ function quiz_upgrade_states($attempt) {
     $session = new stdClass;
     $session->attemptid = $attempt->uniqueid;
     $questionlist = quiz_questions_in_quiz($attempt->layout);
-    if ($questionlist and $states = get_records_select('question_states', "attempt = '$attempt->uniqueid' AND question IN ($questionlist)")) {
+    $params = array($attempt->uniqueid);
+    list($usql, $question_params) = $DB->get_in_or_equal(explode(',',$questionlist));
+    $params = array_merge($params, $question_params);
+
+    if ($questionlist and $states = $DB->get_records_select('question_states', "attempt = ? AND question $usql", $params)) {
         foreach ($states as $state) {
             $session->newgraded = $state->id;
             $session->newest = $state->id;
             $session->questionid = $state->question;
-            insert_record('question_sessions', $session, false);
+            $DB->insert_record('question_sessions', $session, false);
         }
     }
 }
diff --git a/mod/quiz/quizfile.php b/mod/quiz/quizfile.php
index 049870d54b..1296c75fa5 100644
--- a/mod/quiz/quizfile.php
+++ b/mod/quiz/quizfile.php
@@ -18,26 +18,26 @@
     disable_debugging();
 
     $relativepath = get_file_argument('quizfile.php');
-    
+
     if (!$relativepath) {
         print_error('No valid arguments supplied or incorrect server configuration');
     }
-    
+
     // extract relative path components
     $args = explode('/', trim($relativepath, '/'));
     if (count($args) < 3) { // always at least category, question and path
         print_error('No valid arguments supplied');
     }
-    
+
     $quizid       = (int)array_shift($args);
     $questionid   = (int)array_shift($args);
     $relativepath = implode ('/', $args);
 
-    if (!($question = get_record('question', 'id', $questionid))) {
+    if (!($question = $DB->get_record('question', array('id' => $questionid)))) {
         print_error('No valid arguments supplied');
     }
 
-    if (!($questioncategory = get_record('question_categories', 'id', $question->category))) {
+    if (!($questioncategory = $DB->get_record('question_categories', array('id' => $question->category)))) {
         print_error('No valid arguments supplied');
     }
 
@@ -54,17 +54,17 @@
             require_login($questioncategory->course);
             $cm = get_coursemodule_from_instance('quiz', $quizid);
             require_capability('mod/quiz:preview', get_context_instance(CONTEXT_MODULE, $cm->id));
-        }        
+        }
     } else {
-        if (!($quiz = get_record('quiz', 'id', $quizid))) {
+        if (!($quiz = $DB->get_record('quiz', array('id' => $quizid)))) {
             print_error('No valid arguments supplied');
         }
-        if (!($course = get_record('course', 'id', $quiz->course))) {
+        if (!($course = $DB->get_record('course', array('id' => $quiz->course)))) {
             print_error('No valid arguments supplied');
         }
         require_login($course->id);
-        
-        // For now, let's not worry about this.  The following check causes 
+
+        // For now, let's not worry about this.  The following check causes
         // problems sometimes when reviewing a quiz
         //if (!isteacher($course->id)
         //    and !quiz_get_user_attempt_unfinished($quiz->id, $USER->id)
@@ -73,13 +73,13 @@
         //{
         //    print_error("Logged-in user is not allowed to view this quiz");
         //}
-    
+
         ///////////////////////////////////////////////////
         // The logged-in user has the right to view material on this quiz!
         // Now verify the consistency between $quiz, $question, its category and $relativepathname
         ///////////////////////////////////////////////////
-    
-        // For now, let's not worry about this.  The following check doesn't 
+
+        // For now, let's not worry about this.  The following check doesn't
         // work for randomly selected questions and it gets complicated
         //if (!in_array($question->id, explode(',', $quiz->questions), FALSE)) {
         //    print_error("Specified question is not on the specified quiz");
diff --git a/mod/quiz/report.php b/mod/quiz/report.php
index 5f244bf3c3..b7f30e66eb 100644
--- a/mod/quiz/report.php
+++ b/mod/quiz/report.php
@@ -16,19 +16,19 @@
             print_error("There is no coursemodule with id $id");
         }
 
-        if (! $course = get_record("course", "id", $cm->course)) {
+        if (! $course = $DB->get_record('course', array('id' => $cm->course))) {
             print_error("Course is misconfigured");
         }
 
-        if (! $quiz = get_record("quiz", "id", $cm->instance)) {
+        if (! $quiz = $DB->get_record('quiz', array('id' => $cm->instance))) {
             print_error("The quiz with id $cm->instance corresponding to this coursemodule $id is missing");
         }
 
     } else {
-        if (! $quiz = get_record("quiz", "id", $q)) {
+        if (! $quiz = $DB->get_record('quiz', array('id' => $q))) {
             print_error("There is no quiz with id $q");
         }
-        if (! $course = get_record("course", "id", $quiz->course)) {
+        if (! $course = $DB->get_record('course', array('id' => $quiz->course))) {
             print_error("The course with id $quiz->course that the quiz with id $q belongs to is missing");
         }
         if (! $cm = get_coursemodule_from_instance("quiz", $quiz->id, $course->id)) {
@@ -47,9 +47,9 @@
 
     // Upgrade any attempts that have not yet been upgraded to the
     // Moodle 1.5 model (they will not yet have the timestamp set)
-    if ($attempts = get_records_sql("SELECT a.*".
-           "  FROM {$CFG->prefix}quiz_attempts a, {$CFG->prefix}question_states s".
-           " WHERE a.quiz = '$quiz->id' AND s.attempt = a.uniqueid AND s.timestamp = 0")) {
+    if ($attempts = $DB->get_records_sql("SELECT a.*".
+           "  FROM {quiz_attempts} a, {question_states} s".
+           " WHERE a.quiz = ? AND s.attempt = a.uniqueid AND s.timestamp = 0", array($quiz->id))) {
         foreach ($attempts as $attempt) {
             quiz_upgrade_states($attempt);
         }
diff --git a/mod/quiz/report/analysis/report.php b/mod/quiz/report/analysis/report.php
index 1c00c1ff3e..c281307596 100644
--- a/mod/quiz/report/analysis/report.php
+++ b/mod/quiz/report/analysis/report.php
@@ -23,7 +23,7 @@ class quiz_report extends quiz_default_report {
 
     /// Check to see if groups are being used in this quiz
         $currentgroup = groups_get_activity_group($cm, true);
-        
+
         if ($groupmode = groups_get_activity_groupmode($cm)) {   // Groups are being used
             if (!$download) {
                 groups_print_activity_menu($cm, "report.php?id=$cm->id&amp;mode=analysis");
@@ -83,19 +83,21 @@ class quiz_report extends quiz_default_report {
         $groupwhere = '';
 
         //Add this to the SQL to show only group users
+        $params = array($quiz->id, $scorelimit);
         if ($currentgroup) {
-            $groupmembers = ", {$CFG->prefix}groups_members gm ";
-            $groupwhere = "AND gm.groupid = '$currentgroup' AND u.id = gm.userid";
+            $groupmembers = ", {groups_members} gm ";
+            $groupwhere = "AND gm.groupid = ? AND u.id = gm.userid";
+            $params[] = $currentgroup;
         }
 
-        $sql = 'SELECT  qa.* FROM '.$CFG->prefix.'quiz_attempts qa, '.$CFG->prefix.'user u '.$groupmembers.
-                 'WHERE u.id = qa.userid AND qa.quiz = '.$quiz->id.' AND qa.preview = 0 AND ( qa.sumgrades >= '.$scorelimit.' ) '.$groupwhere;
+        $sql = 'SELECT  qa.* FROM {quiz_attempts} qa, {user} u '.$groupmembers.
+                 'WHERE u.id = qa.userid AND qa.quiz = ? AND qa.preview = 0 AND ( qa.sumgrades >= ? ) '.$groupwhere;
 
         // ^^^^^^ es posible seleccionar aqu TODOS los quizzes, como quiere Jussi,
         // pero habra que llevar la cuenta ed cada quiz para restaura las preguntas (quizquestions, states)
 
         /// Fetch the attempts
-        $attempts = get_records_sql($sql);
+        $attempts = $DB->get_records_sql($sql, $params);
 
         if(empty($attempts)) {
             print_heading(get_string('nothingtodisplay'));
@@ -104,10 +106,10 @@ class quiz_report extends quiz_default_report {
         }
         $questions = array();
         $getquestiondata = true ;
-        $this->get_questions_atttempts_data ($quiz,&$questions,&$attempts,$attemptselection,$usermax);
+        $this->get_questions_atttempts_data ($quiz,$questions,$attempts,$attemptselection,$usermax);
 
 /*    This is the code before creating the get_questions_atttempts_data function
-///     will remove these lines when the new function gets approval 
+///     will remove these lines when the new function gets approval
 /// Here we rewiew all attempts and record data to construct the table
         $questions = array();
         $statstable = array();
@@ -139,8 +141,8 @@ class quiz_report extends quiz_default_report {
             if ($attemptselection == QUIZ_ALLATTEMPTS || $userscore == $usermax[$attempt->userid]) {
 
             $sql = "SELECT q.*, i.grade AS maxgrade, i.id AS instance".
-                   "  FROM {$CFG->prefix}question q,".
-                   "       {$CFG->prefix}quiz_question_instances i".
+                   "  FROM {question} q,".
+                   "       {quiz_question_instances} i".
                    " WHERE i.quiz = '$quiz->id' AND q.id = i.question".
                    "   AND q.id IN ($questionlist)";
 
@@ -166,7 +168,7 @@ class quiz_report extends quiz_default_report {
                 $qtype = ($quizquestions[$i]->qtype=='random') ? $states[$i]->options->question->qtype : $quizquestions[$i]->qtype;
                 if($quizquestions[$i]->qtype =='randomsamatch'){
                     $quizquestions[$i]->options =$states[$i]->options ;
-                }   
+                }
                 $q = get_question_responses($quizquestions[$i], $states[$i]);
                 if (empty($q)){
                     continue;
@@ -225,10 +227,10 @@ class quiz_report extends quiz_default_report {
                 $rpercent =  '('.format_float($q['rcounts'][$aid]/$q['count']*100,0).'%)';
                 $questions[$qid]['rpercent'][$aid] = $rpercent ;
             }
-  
+
         }
-                
-            
+
+
         unset($attemptscores);
         unset($statstable);
 */
@@ -244,7 +246,7 @@ class quiz_report extends quiz_default_report {
                 break;
             case "CSV":
                 $this->Export_CSV($questions, $filename);
-                break;            
+                break;
             case "HTML":
                 $this->Export_HTML($questions, $filename);
                 break;
@@ -333,7 +335,7 @@ class quiz_report extends quiz_default_report {
         foreach($pagequestions as $qnum) {
             $q = $questions[$qnum];
             $qid = $q['id'];
-            $question = get_record('question', 'id', $qid);
+            $question = $DB->get_record('question', array('id' => $qid));
             $qnumber = " (".link_to_popup_window('/question/question.php?id='.$qid,'editquestion', $qid, 450, 550, get_string('edit'), 'none', true ).") ";
             $qname = '<div class="qname">'.format_text($question->name." :  ", $question->questiontextformat, $format_options, $quiz->course).'</div>';
             $qicon = print_question_icon($question, true);
@@ -450,8 +452,8 @@ class quiz_report extends quiz_default_report {
 }
 
     function get_questions_atttempts_data ($quiz,&$questions,&$attempts,$attemptselection,$usermax){
-        global $CFG, $SESSION, $QTYPES;
-    
+        global $CFG, $SESSION, $QTYPES, $DB;
+
     /// Here we rewiew all attempts and record data to construct the table
         $statstable = array();
         $questionarray = array();
@@ -481,13 +483,15 @@ class quiz_report extends quiz_default_report {
 
             if ($attemptselection == QUIZ_ALLATTEMPTS || $userscore == $usermax[$attempt->userid]) {
 
+            list($usql, $params) = $DB->get_in_or_equal(explode(',', $questionlist));
+            $params = array_merge(array($quiz->id), $params);
             $sql = "SELECT q.*, i.grade AS maxgrade, i.id AS instance".
-                   "  FROM {$CFG->prefix}question q,".
-                   "       {$CFG->prefix}quiz_question_instances i".
-                   " WHERE i.quiz = '$quiz->id' AND q.id = i.question".
-                   "   AND q.id IN ($questionlist)";
+                   "  FROM {question} q,".
+                   "       {quiz_question_instances} i".
+                   " WHERE i.quiz = ? AND q.id = i.question".
+                   "   AND q.id $usql";
 
-            if (!$quizquestions = get_records_sql($sql)) {
+            if (!$quizquestions = $DB->get_records_sql($sql, $params)) {
                 print_error('No questions found');
             }
 
@@ -509,7 +513,7 @@ class quiz_report extends quiz_default_report {
                 $qtype = ($quizquestions[$i]->qtype=='random') ? $states[$i]->options->question->qtype : $quizquestions[$i]->qtype;
                 if($quizquestions[$i]->qtype =='randomsamatch'){
                     $quizquestions[$i]->options =$states[$i]->options ;
-                }   
+                }
                 $q = get_question_responses($quizquestions[$i], $states[$i]);
                 if (empty($q)){
                     continue;
@@ -569,10 +573,10 @@ class quiz_report extends quiz_default_report {
                 $questions[$qid]['rpercent'][$aid] = $rpercent ;
             }
             $SESSION->quiz_analysis_table['question'][$qid]=$questions[$qid] ;
-  
+
         }
-                
-            
+
+
         unset($attemptscores);
         unset($statstable);
     }
@@ -669,11 +673,11 @@ class quiz_report extends quiz_default_report {
     /// Here starts workshhet headers
         $myxls->write_string(0,0,$sheettitle,$formatb);
 
-        $headers = array(strip_tags(get_string('row','quiz_analysis')),strip_tags(get_string('qidtitle','quiz_analysis')), 
+        $headers = array(strip_tags(get_string('row','quiz_analysis')),strip_tags(get_string('qidtitle','quiz_analysis')),
                         strip_tags(get_string('index','quiz_analysis')),strip_tags(get_string('qtypetitle','quiz_analysis')),
                         strip_tags(get_string('qnametitle','quiz_analysis')), strip_tags(get_string('qtexttitle','quiz_analysis')),
                         strip_tags(get_string('responsestitle','quiz_analysis')), strip_tags(get_string('rfractiontitle','quiz_analysis')),
-                        strip_tags(get_string('rcounttitle','quiz_analysis')), 
+                        strip_tags(get_string('rcounttitle','quiz_analysis')),
                         strip_tags(get_string('rcounttitle','quiz_analysis').'/'.get_string('qcounttitle','quiz_analysis')),
                         strip_tags(get_string('rpercenttitle','quiz_analysis')), strip_tags(get_string('qcounttitle','quiz_analysis')),
                         strip_tags(get_string('facilitytitle','quiz_analysis')), strip_tags(get_string('stddevtitle','quiz_analysis')),
@@ -686,7 +690,7 @@ class quiz_report extends quiz_default_report {
         }
 
         $row = 3;
-        
+
         foreach($questions as $q) {
             $r = $row -2;
             $rows = $this->print_row_stats_data($q,$r);
@@ -751,11 +755,11 @@ class quiz_report extends quiz_default_report {
         $formatblue->set_align('center');
     /// Here starts workshhet headers
         $myxls->write_string(0,0,$sheettitle,$formatb);
-        $headers = array(strip_tags(get_string('row','quiz_analysis')),strip_tags(get_string('qidtitle','quiz_analysis')), 
+        $headers = array(strip_tags(get_string('row','quiz_analysis')),strip_tags(get_string('qidtitle','quiz_analysis')),
                         strip_tags(get_string('index','quiz_analysis')),strip_tags(get_string('qtypetitle','quiz_analysis')),
                         strip_tags(get_string('qnametitle','quiz_analysis')), strip_tags(get_string('qtexttitle','quiz_analysis')),
                         strip_tags(get_string('responsestitle','quiz_analysis')), strip_tags(get_string('rfractiontitle','quiz_analysis')),
-                        strip_tags(get_string('rcounttitle','quiz_analysis')), 
+                        strip_tags(get_string('rcounttitle','quiz_analysis')),
                         strip_tags(get_string('rcounttitle','quiz_analysis').'/'.get_string('qcounttitle','quiz_analysis')),
                         strip_tags(get_string('rpercenttitle','quiz_analysis')), strip_tags(get_string('qcounttitle','quiz_analysis')),
                         strip_tags(get_string('facilitytitle','quiz_analysis')), strip_tags(get_string('stddevtitle','quiz_analysis')),
@@ -788,11 +792,11 @@ class quiz_report extends quiz_default_report {
 
     function Export_CSV(&$questions, $filename) {
 
-        $headers = array(strip_tags(get_string('row','quiz_analysis')),strip_tags(get_string('qidtitle','quiz_analysis')), 
+        $headers = array(strip_tags(get_string('row','quiz_analysis')),strip_tags(get_string('qidtitle','quiz_analysis')),
                         strip_tags(get_string('index','quiz_analysis')),strip_tags(get_string('qtypetitle','quiz_analysis')),
                         strip_tags(get_string('qnametitle','quiz_analysis')), strip_tags(get_string('qtexttitle','quiz_analysis')),
                         strip_tags(get_string('responsestitle','quiz_analysis')), strip_tags(get_string('rfractiontitle','quiz_analysis')),
-                        strip_tags(get_string('rcounttitle','quiz_analysis')), 
+                        strip_tags(get_string('rcounttitle','quiz_analysis')),
                         strip_tags(get_string('rcounttitle','quiz_analysis').'/'.get_string('qcounttitle','quiz_analysis')),
                         strip_tags(get_string('rpercenttitle','quiz_analysis')), strip_tags(get_string('qcounttitle','quiz_analysis')),
                         strip_tags(get_string('facilitytitle','quiz_analysis')), strip_tags(get_string('stddevtitle','quiz_analysis')),
@@ -809,7 +813,7 @@ class quiz_report extends quiz_default_report {
         header("Pragma: public");
 
         echo $text;
-        
+
         $row = 1;
         foreach($questions as $q) {
             $rows = $this->print_row_stats_data_CSV($q,$row);
@@ -821,10 +825,12 @@ class quiz_report extends quiz_default_report {
         }
         exit;
     }
-        function print_row_stats_data_CSV(&$q,&$index) {
+
+    function print_row_stats_data_CSV(&$q,&$index) {
+        global $DB;
         $qid = $q['id'];
-        $question = get_record('question', 'id', $qid);
-        
+        $question = $DB->get_record('question', array('id' => $qid));
+
         $options = new stdClass;
         $options->para = false;
         $options->noclean = true;
@@ -836,9 +842,9 @@ class quiz_report extends quiz_default_report {
         $order = array("\r\n", "\n", "\r");
         $trans = str_replace($order,' ',$trans);
        // $trans = explode(',',$trans);
-        
+
        // $qtext = format_text(implode('__',$trans), FORMAT_MOODLE, $options);
-        
+
         $qtext = format_text($trans, FORMAT_MOODLE, $options);
         $responses = array();
         foreach ($q['responses'] as $aid=>$resp){
@@ -884,13 +890,13 @@ class quiz_report extends quiz_default_report {
         $headers[] = '<font color="blue"><strong>'.get_string('qidtitle','quiz_analysis').'</strong></font>';
         $headers[] = '<font color="blue"><strong>'.get_string('qtypetitle','quiz_analysis').'</strong></font>';
         $headers[] = '<font color="green"><strong>'.get_string('qnametitle','quiz_analysis').':</strong></font>'.'<br />'.'<font color="blue"><strong>'.get_string('qtexttitle','quiz_analysis').'</strong></font>';
-        $headers[] = '<font color="blue"><strong>'.get_string('responsestitle','quiz_analysis').'</strong></font>'; 
+        $headers[] = '<font color="blue"><strong>'.get_string('responsestitle','quiz_analysis').'</strong></font>';
         $headers[] = '<font color="blue"><strong>'.get_string('rfractiontitle','quiz_analysis').'</strong></font>';
         $headers[] = '<font color="blue"><strong>'.get_string('rcounttitle','quiz_analysis').' / '.get_string('qcounttitle','quiz_analysis').'</strong></font>';
         $headers[] = '<font color="blue"><strong>'.get_string('rpercenttitle','quiz_analysis').'</strong></font>';
-        $headers[] = '<font color="blue"><strong>'.get_string('facilitytitle','quiz_analysis').'</strong></font>'; 
+        $headers[] = '<font color="blue"><strong>'.get_string('facilitytitle','quiz_analysis').'</strong></font>';
         $headers[] = '<font color="blue"><strong>'.get_string('stddevtitle','quiz_analysis').'</strong></font>';
-        $headers[] = '<font color="blue"><strong>'.get_string('dicsindextitle','quiz_analysis').'</strong></font>'; 
+        $headers[] = '<font color="blue"><strong>'.get_string('dicsindextitle','quiz_analysis').'</strong></font>';
         $headers[] = '<font color="blue"><strong>'.get_string('disccoefftitle','quiz_analysis').'</strong></font>';
         $text = implode("</td><td>", $headers)." \n";
 
@@ -900,7 +906,7 @@ class quiz_report extends quiz_default_report {
         header("Expires: 0");
         header("Cache-Control: must-revalidate,post-check=0,pre-check=0");
         header("Pragma: public");
-        print_header();        
+        print_header();
         echo '<table border = "1" bordercolor="#808080" cellspacing = "0" >';
         echo '<tr><td>'.$text.'</td></tr>';
          foreach($questions as $q) {
@@ -916,14 +922,14 @@ class quiz_report extends quiz_default_report {
         exit;
     }
     function print_row_stats_data_html(&$q) {
-        global $QTYPE_MENU ;
+        global $QTYPE_MENU, $DB ;
         $format_options = new stdClass;
         $format_options->para = false;
         $format_options->noclean = true;
         $format_options->newlines = false;
 
             $qid = $q['id'];
-            $question = get_record('question', 'id', $qid);
+            $question = $DB->get_record('question', array('id' => $qid));
             $qnumber = "".$qid."";
             $qname = '<font color="green">'.format_text($question->name, $question->questiontextformat, $format_options).':</font><br />';
             $qicon = '';//print_question_icon($question, true);
@@ -966,8 +972,9 @@ class quiz_report extends quiz_default_report {
             return $result;
           }
     function print_row_stats_data(&$q, &$index) {
+        global $DB;
         $qid = $q['id'];
-        $question = get_record('question', 'id', $qid);
+        $question = $DB->get_record('question', array('id' => $qid));
 
         $options = new stdClass;
         $options->para = false;
diff --git a/mod/quiz/report/grading/report.php b/mod/quiz/report/grading/report.php
index d68b54802f..290bcb1f59 100644
--- a/mod/quiz/report/grading/report.php
+++ b/mod/quiz/report/grading/report.php
@@ -28,17 +28,17 @@ class quiz_report extends quiz_default_report {
      * Displays the report.
      */
     function display($quiz, $cm, $course) {
-        global $CFG, $QTYPES;
-        
+        global $CFG, $QTYPES, $DB;
+
         $viewoptions = array('mode'=>'grading', 'q'=>$quiz->id);
 
         if ($questionid = optional_param('questionid', 0, PARAM_INT)){
             $viewoptions += array('questionid'=>$questionid);
         }
-        
+
         // grade question specific parameters
         $gradeungraded  = optional_param('gradeungraded', 0, PARAM_INT);
-        
+
         if ($userid    = optional_param('userid', 0, PARAM_INT)){
             $viewoptions += array('userid'=>$userid);
         }
@@ -54,10 +54,10 @@ class quiz_report extends quiz_default_report {
         if ($gradenextungraded  = optional_param('gradenextungraded', 0, PARAM_INT)){
             $viewoptions += array('gradenextungraded'=> $gradenextungraded);
         }
-        
-        
+
+
         $this->cm = $cm;
-        
+
         $this->print_header_and_tabs($cm, $course, $quiz, $reportmode="grading");
 
         // Check permissions
@@ -73,7 +73,7 @@ class quiz_report extends quiz_default_report {
                 unset($gradeableqs[$qid]);
             }
         }
-        
+
         if (empty($gradeableqs)) {
             print_heading(get_string('noessayquestionsfound', 'quiz'));
             return false;
@@ -92,7 +92,7 @@ class quiz_report extends quiz_default_report {
             } else {
                 $question =& $gradeableqs[$questionid];
             }
-            $question->maxgrade = get_field('quiz_question_instances', 'grade', 'quiz', $quiz->id, 'question', $question->id);
+            $question->maxgrade = $DB->get_field('quiz_question_instances', 'grade', array('quiz' => $quiz->id, 'question' => $question->id));
 
             // Some of the questions code is optimised to work with several questions
             // at once so it wants the question to be in an array. The array key
@@ -121,10 +121,12 @@ class quiz_report extends quiz_default_report {
             foreach($data->manualgrades as $uniqueid => $response) {
                 // get our attempt
                 $uniqueid = clean_param($uniqueid, PARAM_INT);
-                if (!$attempt = get_record_sql("SELECT * FROM {$CFG->prefix}quiz_attempts " .
-                                "WHERE uniqueid = $uniqueid AND " .
-                                "userid IN ($this->userids) AND " .
-                                "quiz=".$quiz->id)){
+                list($usql, $params) = $DB->get_in_or_equal(explode(',', $this->userids));
+
+                if (!$attempt = $DB->get_record_sql("SELECT * FROM {quiz_attempts} " .
+                                "WHERE uniqueid = ? AND " .
+                                "userid $usql AND " .
+                                "quiz=?", array_merge(array($uniqueid), $params, array($quiz->id)))){
                     error('No such attempt ID exists');
                 }
 
@@ -152,7 +154,7 @@ class quiz_report extends quiz_default_report {
                 notify(get_string('changessavedwitherrors', 'quiz'), 'notifysuccess');
             }
         }
-        $this->viewurl = new moodle_url($CFG->wwwroot.'/mod/quiz/report.php', $viewoptions); 
+        $this->viewurl = new moodle_url($CFG->wwwroot.'/mod/quiz/report.php', $viewoptions);
         /// find out current groups mode
 
         if ($groupmode = groups_get_activity_groupmode($this->cm)) {   // Groups are being used
@@ -231,8 +233,7 @@ class quiz_report extends quiz_default_report {
      *       Finnish documenting
      **/
     function view_question($quiz, $question, $totalattempts, $ungraded) {
-        global $CFG;
-
+        global $CFG, $DB;
 
         $usercount = count($this->users);
 
@@ -267,7 +268,7 @@ class quiz_report extends quiz_default_report {
         // get it ready!
         $table->setup();
 
-        list($select, $from, $where) = $this->attempts_sql($quiz->id, true, $question->id);
+        list($select, $from, $where, $params) = $this->attempts_sql($quiz->id, true, $question->id);
 
         if($table->get_sql_where()) { // forgot what this does
             $where .= 'AND '.$table->get_sql_where();
@@ -285,7 +286,7 @@ class quiz_report extends quiz_default_report {
         $table->pagesize(QUIZ_REPORT_DEFAULT_PAGE_SIZE, $totalattempts);
 
         // get the attempts and process them
-        if ($attempts = get_records_sql($select.$from.$where.$sort,$table->get_page_start(), $table->get_page_size())) {
+        if ($attempts = $DB->get_records_sql($select.$from.$where.$sort, $params, $table->get_page_start(), $table->get_page_size())) {
             // grade all link
             $links = "<strong><a href=\"report.php?mode=grading&amp;gradeall=1&amp;q=$quiz->id&amp;questionid=$question->id\">".get_string('gradeall', 'quiz_grading', $totalattempts).'</a></strong>';
             if ($ungraded>0){
@@ -337,7 +338,7 @@ class quiz_report extends quiz_default_report {
      * @todo Finish documenting this function
      **/
     function print_questions_and_form($quiz, $question, $userid, $attemptid, $gradeungraded, $gradenextungraded, $ungraded) {
-        global $CFG;
+        global $CFG, $DB;
 
         // TODO get the context, and put in proper roles an permissions checks.
         $context = NULL;
@@ -345,16 +346,16 @@ class quiz_report extends quiz_default_report {
         $questions[$question->id] = &$question;
         $usehtmleditor = can_use_html_editor();
 
-        list($select, $from, $where) = $this->attempts_sql($quiz->id, false, $question->id, $userid, $attemptid, $gradeungraded, $gradenextungraded);
+        list($select, $from, $where, $params) = $this->attempts_sql($quiz->id, false, $question->id, $userid, $attemptid, $gradeungraded, $gradenextungraded);
 
         $sort = 'ORDER BY u.firstname, u.lastname, qa.attempt ASC';
-        
+
         if ($gradenextungraded){
             $limit = ' LIMIT '.QUIZ_REPORT_DEFAULT_GRADING_PAGE_SIZE;
         } else {
             $limit = '';
         }
-        $attempts = get_records_sql($select.$from.$where.$sort.$limit);
+        $attempts = $DB->get_records_sql($select.$from.$where.$sort.$limit, $params);
         if ($attempts){
             $firstattempt = current($attempts);
             $fullname = fullname($firstattempt);
@@ -372,54 +373,54 @@ class quiz_report extends quiz_default_report {
             } else {
                 print_heading(get_string('gradingall','quiz_grading', count($attempts)), '', 3);
             }
-    
+
             // Display the form with one part for each selected attempt
-    
+
             echo '<form method="post" action="report.php">'.
                 '<input type="hidden" name="mode" value="grading" />'.
                 '<input type="hidden" name="q" value="'.$quiz->id.'" />'.
                 '<input type="hidden" name="sesskey" value="'.sesskey().'" />'.
                 '<input type="hidden" name="questionid" value="'.$question->id.'" />';
-    
+
             foreach ($attempts as $attempt) {
-    
+
                 // Load the state for this attempt (The questions array was created earlier)
                 $states = get_question_states($questions, $quiz, $attempt);
                 // The $states array is indexed by question id but because we are dealing
                 // with only one question there is only one entry in this array
                 $state = &$states[$question->id];
-    
+
                 $options = quiz_get_reviewoptions($quiz, $attempt, $context);
                 unset($options->questioncommentlink);
                 $copy = $state->manualcomment;
                 $state->manualcomment = '';
-    
+
                 $options->readonly = 1;
-                
+
                 $gradedclass = question_state_is_graded($state)?' class="highlightgraded" ':'';
                 $gradedstring = question_state_is_graded($state)?(' '.get_string('graded','quiz_grading')):'';
                 $a = new object();
                 $a->fullname = fullname($attempt, true);
                 $a->attempt = $attempt->attempt;
-                
+
                 // print the user name, attempt count, the question, and some more hidden fields
                 echo '<div class="boxaligncenter" width="80%" style="clear:left;padding:15px;">';
                 echo "<span$gradedclass>".get_string('gradingattempt','quiz_grading', $a);
                 echo $gradedstring."</span>";
-    
+
                 print_question($question, $state, '', $quiz, $options);
-    
+
                 $prefix         = "manualgrades[$attempt->uniqueid]";
                 $grade          = round($state->last_graded->grade, 3);
                 $state->manualcomment = $copy;
-    
+
                 include($CFG->dirroot . '/question/comment.html');
-    
+
                 echo '</div>';
             }
             echo '<div class="boxaligncenter"><input type="submit" value="'.get_string('savechanges').'" /></div>'.
                 '</form>';
-    
+
             if ($usehtmleditor) {
                 use_html_editor();
             }
@@ -427,40 +428,50 @@ class quiz_report extends quiz_default_report {
             notify(get_string('noattemptstoshow', 'quiz'));
         }
     }
-    
+
     function attempts_sql($quizid, $wantstateevent=false, $questionid=0, $userid=0, $attemptid=0, $gradeungraded=0, $gradenextungraded=0){
-        global $CFG;
+        global $CFG, $DB;
         // this sql joins the attempts table and the user table
         $select = 'SELECT qa.id AS attemptid, qa.uniqueid, qa.attempt, qa.timefinish, qa.preview,
                     u.id AS userid, u.firstname, u.lastname, u.picture ';
         if ($wantstateevent){
             $select .= ', qs.event ';
         }
-        $from   = 'FROM '.$CFG->prefix.'user u, ' .
-                $CFG->prefix.'quiz_attempts qa ';
+        $from   = 'FROM {user} u, ' .
+                '{quiz_attempts} qa ';
+        $params = array();
+
         if (($wantstateevent|| $gradenextungraded || $gradeungraded) && $questionid){
-            $from .= "LEFT JOIN {$CFG->prefix}question_sessions qns " .
-                    "ON (qns.attemptid = qa.uniqueid AND qns.questionid = $questionid) ";
-            $from .=  "LEFT JOIN  {$CFG->prefix}question_states qs " .
-                    "ON (qs.id = qns.newgraded AND qs.question = $questionid) ";
+            $from .= "LEFT JOIN {question_sessions} qns " .
+                    "ON (qns.attemptid = qa.uniqueid AND qns.questionid = ?) ";
+            $params[] = $questionid;
+            $from .=  "LEFT JOIN  {question_states} qs " .
+                    "ON (qs.id = qns.newgraded AND qs.question = ?) ";
+            $params[] = $questionid;
         }
+        list($usql, $u_params) = $DB->get_in_or_equal(explode(',', $this->userids));
         if ($gradenextungraded || $gradeungraded) { // get ungraded attempts
-            $where = 'WHERE u.id IN ('.$this->userids.') AND qs.event NOT IN ('.QUESTION_EVENTS_GRADED.') ';
+            $where = 'WHERE u.id $usql AND qs.event NOT IN ('.QUESTION_EVENTS_GRADED.') ';
+            $params = array_merge($params, $u_params);
         } else if ($userid) { // get all the attempts for a specific user
-            $where = 'WHERE u.id='.$userid.' ';
+            $where = 'WHERE u.id=?';
+            $params[] = $userid;
         } else if ($attemptid) { // get a specific attempt
-            $where = 'WHERE qa.id='.$attemptid.' ';
+            $where = 'WHERE qa.id=? ';
+            $params[] = $attemptid;
         } else { // get all user attempts
-            $where  = 'WHERE u.id IN ('.$this->userids.') ';
+            $where  = "WHERE u.id $usql ";
+            $params = array_merge($params, $u_params);
         }
-        
-        $where .= ' AND u.id = qa.userid AND qa.quiz = '.$quizid;
+
+        $where .= ' AND u.id = qa.userid AND qa.quiz = ?';
+        $params[] = $quizid;
         // ignore previews
         $where .= ' AND preview = 0 ';
 
         $where .= ' AND qa.timefinish != 0 ';
 
-        return array($select, $from, $where);
+        return array($select, $from, $where, $params);
     }
 
 }
diff --git a/mod/quiz/report/overview/overview_table.php b/mod/quiz/report/overview/overview_table.php
index 12614dd817..dd891676b9 100644
--- a/mod/quiz/report/overview/overview_table.php
+++ b/mod/quiz/report/overview/overview_table.php
@@ -1,13 +1,13 @@
 <?php  // $Id$
 
 class quiz_report_overview_table extends table_sql {
-    
+
     var $useridfield = 'userid';
-    
+
     var $candelete;
     var $reporturl;
     var $displayoptions;
-    
+
     function quiz_report_overview_table($quiz , $qmsubselect, $groupstudents,
                 $students, $detailedmarks, $questions, $candelete, $reporturl, $displayoptions){
         parent::table_sql('mod-quiz-report-overview-report');
@@ -22,17 +22,18 @@ class quiz_report_overview_table extends table_sql {
         $this->displayoptions = $displayoptions;
     }
     function build_table(){
-        global $CFG;
+        global $CFG, $DB;
         if ($this->rawdata) {
             // Define some things we need later to process raw data from db.
             $this->strtimeformat = get_string('strftimedatetime');
             parent::build_table();
             //end of adding data from attempts data to table / download
             //now add averages at bottom of table :
+            $params = array($this->quiz->id);
             $averagesql = "SELECT AVG(qg.grade) AS grade " .
-                    "FROM {$CFG->prefix}quiz_grades qg " .
-                    "WHERE quiz=".$this->quiz->id;
-                    
+                    "FROM {quiz_grades} qg " .
+                    "WHERE quiz=?";
+
             $this->add_separator();
             if ($this->is_downloading()){
                 $namekey = 'lastname';
@@ -40,8 +41,10 @@ class quiz_report_overview_table extends table_sql {
                 $namekey = 'fullname';
             }
             if ($this->groupstudents){
-                $groupaveragesql = $averagesql." AND qg.userid IN ($this->groupstudents)";
-                $groupaverage = get_record_sql($groupaveragesql);
+                list($g_usql, $g_params) = $DB->get_in_or_equal(explode(',', $this->groupstudents));
+
+                $groupaveragesql = $averagesql." AND qg.userid $g_usql";
+                $groupaverage = $DB->get_record_sql($groupaveragesql, array_merge($params, $g_params));
                 $groupaveragerow = array($namekey => get_string('groupavg', 'grades'),
                         'sumgrades' => round($groupaverage->grade, $this->quiz->decimalpoints),
                         'feedbacktext'=> strip_tags(quiz_report_feedback_for_grade($groupaverage->grade, $this->quiz->id)));
@@ -51,7 +54,9 @@ class quiz_report_overview_table extends table_sql {
                 }
                 $this->add_data_keyed($groupaveragerow);
             }
-            $overallaverage = get_record_sql($averagesql." AND qg.userid IN ($this->students)");
+
+            list($s_usql, $s_params) = $DB->get_in_or_equal(explode(',', $this->students));
+            $overallaverage = $DB->get_record_sql($averagesql." AND qg.userid $s_usql", array_merge($params, $s_params));
             $overallaveragerow = array($namekey => get_string('overallaverage', 'grades'),
                         'sumgrades' => round($overallaverage->grade, $this->quiz->decimalpoints),
                         'feedbacktext'=> strip_tags(quiz_report_feedback_for_grade($overallaverage->grade, $this->quiz->id)));
@@ -62,7 +67,7 @@ class quiz_report_overview_table extends table_sql {
             $this->add_data_keyed($overallaveragerow);
         }
     }
-    
+
     function wrap_html_start(){
         if (!$this->is_downloading()) {
             if ($this->candelete) {
@@ -96,7 +101,7 @@ class quiz_report_overview_table extends table_sql {
         }
     }
 
-    
+
     function col_checkbox($attempt){
         if ($attempt->attempt){
             return '<input type="checkbox" name="attemptid[]" value="'.$attempt->attempt.'" />';
@@ -104,13 +109,13 @@ class quiz_report_overview_table extends table_sql {
             return '';
         }
     }
-    
+
     function col_picture($attempt){
         global $COURSE;
         return print_user_picture($attempt->userid, $COURSE->id, $attempt->picture, false, true);
     }
 
-    
+
     function col_timestart($attempt){
         if ($attempt->attempt) {
             $startdate = userdate($attempt->timestart, $this->strtimeformat);
@@ -139,7 +144,7 @@ class quiz_report_overview_table extends table_sql {
             return  '-';
         }
     }
-    
+
     function col_duration($attempt){
         if ($attempt->timefinish) {
             return format_time($attempt->duration);
@@ -195,12 +200,12 @@ class quiz_report_overview_table extends table_sql {
                         'none', true);
             } else {
                 return $grade;
-            }     
+            }
         } else {
             return NULL;
         }
     }
-    
+
     function col_feedbacktext($attempt){
         if ($attempt->timefinish) {
             if (!$this->is_downloading()) {
@@ -211,7 +216,7 @@ class quiz_report_overview_table extends table_sql {
         } else {
             return '-';
         }
-    
+
     }
 }
 ?>
diff --git a/mod/quiz/report/overview/overviewgraph.php b/mod/quiz/report/overview/overviewgraph.php
index 37d266a62f..88d65faf69 100644
--- a/mod/quiz/report/overview/overviewgraph.php
+++ b/mod/quiz/report/overview/overviewgraph.php
@@ -5,8 +5,8 @@ include $CFG->dirroot."/mod/quiz/report/reportlib.php";
 
 $quizid = required_param('id', PARAM_INT);
 
-$quiz = get_record('quiz', 'id', $quizid);
-$course = get_record('course', 'id', $quiz->course);
+$quiz = $DB->get_record('quiz', array('id' => $quizid));
+$course = $DB->get_record('course', array('id' => $quiz->course));
 require_login($course);
 $cm = get_coursemodule_from_instance('quiz', $quizid);
 $currentgroup = groups_get_activity_group($cm);
@@ -55,7 +55,7 @@ for ($i=0;$i < $quiz->grade;$i += $bandwidth){
         $label .= number_format($quiz->grade, $quiz->decimalpoints);
     }
     $bandlabels[] = $label;
-} 
+}
 $line->x_data          = $bandlabels;
 
 $useridlist = join(',',array_keys(get_users_by_capability($modcontext, 'mod/quiz:attempt','','','','','','',false)));
@@ -80,7 +80,7 @@ $line->y_format['allusers'] =
 
 
 $line->parameter['y_min_left'] = 0;  // start at 0
-$line->parameter['y_max_left'] = max($line->y_data['allusers']); 
+$line->parameter['y_max_left'] = max($line->y_data['allusers']);
 $line->parameter['y_decimal_left'] = 0; // 2 decimal places for y axis.
 
 
@@ -94,6 +94,6 @@ while ($gridlines >= 10){
     }
 }
 
-$line->parameter['y_axis_gridlines'] = $gridlines+1; 
+$line->parameter['y_axis_gridlines'] = $gridlines+1;
 $line->draw();
 ?>
diff --git a/mod/quiz/report/overview/report.php b/mod/quiz/report/overview/report.php
index ee9bf3ed40..87ccdeda98 100644
--- a/mod/quiz/report/overview/report.php
+++ b/mod/quiz/report/overview/report.php
@@ -18,7 +18,7 @@ class quiz_report extends quiz_default_report {
      * Display the report.
      */
     function display($quiz, $cm, $course) {
-        global $CFG, $COURSE;
+        global $CFG, $COURSE, $DB;
 
         $context = get_context_instance(CONTEXT_MODULE, $cm->id);
 
@@ -53,13 +53,14 @@ class quiz_report extends quiz_default_report {
         $pageoptions['mode'] = 'overview';
 
         $reporturl = new moodle_url($CFG->wwwroot.'/mod/quiz/report.php', $pageoptions);
-        $qmsubselect = quiz_report_qm_filter_subselect($quiz);
+        list($qmsubselect, $params) = quiz_report_qm_filter_subselect($quiz); // careful: these are named params in $params!!
+
         $mform = new mod_quiz_report_overview_settings($reporturl, array('qmsubselect'=> $qmsubselect, 'quiz'=>$quiz));
         if ($fromform = $mform->get_data()){
             $attemptsmode = $fromform->attemptsmode;
             if ($qmsubselect){
                 //control is not on the form if
-                //the grading method is not set 
+                //the grading method is not set
                 //to grade one attempt per user eg. for average attempt grade.
                 $qmfilter = $fromform->qmfilter;
             } else {
@@ -83,7 +84,7 @@ class quiz_report extends quiz_default_report {
         }
         // We only want to show the checkbox to delete attempts
         // if the user has permissions and if the report mode is showing attempts.
-        $candelete = has_capability('mod/quiz:deleteattempts', $context) 
+        $candelete = has_capability('mod/quiz:deleteattempts', $context)
                 && ($attemptsmode!= QUIZ_REPORT_ATTEMPTS_STUDENTS_WITH_NO);
 
 
@@ -98,19 +99,19 @@ class quiz_report extends quiz_default_report {
         if (!$students = get_users_by_capability($context, 'mod/quiz:attempt','','','','','','',false)){
             $students = array();
         }
-        
+
         $studentslist = join(',',array_keys($students));
         if (empty($currentgroup)) {
             // all users who can attempt quizzes
             $groupstudentslist = '';
-            $allowedlist = $studentslist;
+            $allowedlist = explode(',', $studentslist);
         } else {
             // all users who can attempt quizzes and who are in the currently selected group
             if (!$groupstudents = get_users_by_capability($context, 'mod/quiz:attempt','','','','',$currentgroup,'',false)){
                 $groupstudents = array();
             }
-            $groupstudentslist = join(',', array_keys($groupstudents));
-            $allowedlist = $groupstudentslist;
+            $allowedlist = array_keys($groupstudents);
+            $groupstudentslist = join(',', $allowedlist);
         }
 
         if ($detailedmarks) {
@@ -148,27 +149,29 @@ class quiz_report extends quiz_default_report {
             return true;
         }
         // Print information on the grading method and whether we are displaying
-        // 
+        //
         if (!$table->is_downloading()) { //do not print notices when downloading
             if ($strattempthighlight = quiz_report_highlighting_grading_method($quiz, $qmsubselect, $qmfilter)) {
                 echo '<div class="quizattemptcounts">' . $strattempthighlight . '</div>';
             }
         }
-        
-        
+
+
         $showgrades = $quiz->grade && $quiz->sumgrades && $reviewoptions->scores;
         $hasfeedback = quiz_has_feedback($quiz->id) && $quiz->grade > 1.e-7 && $quiz->sumgrades > 1.e-7;
 
 
         // Construct the SQL
-        $fields = sql_concat('u.id', '\'#\'', 'COALESCE(qa.attempt, \'0\')').' AS uniqueid, '.
+        $fields = $DB->sql_concat('u.id', '\'#\'', 'COALESCE(qa.attempt, \'0\')').' AS uniqueid, '.
             ($qmsubselect?$qmsubselect.' AS gradedattempt, ':'').
             'qa.uniqueid AS attemptuniqueid, qa.id AS attempt, u.id AS userid, u.idnumber, u.firstname, u.lastname, u.picture, '.
             'qa.sumgrades, qa.timefinish, qa.timestart, qa.timefinish - qa.timestart AS duration ';
 
         // This part is the same for all cases - join users and quiz_attempts tables
-        $from = $CFG->prefix.'user u ';
-        $from .= 'LEFT JOIN '.$CFG->prefix.'quiz_attempts qa ON qa.userid = u.id AND qa.quiz = '.$quiz->id;
+        $from = '{user} u ';
+        $from .= 'LEFT JOIN {quiz_attempts} qa ON qa.userid = u.id AND qa.quiz = :quizid';
+        $params["quizid"] = $quiz->id;
+
         if ($qmsubselect && $qmfilter){
             $from .= ' AND '.$qmsubselect;
         }
@@ -179,18 +182,25 @@ class quiz_report extends quiz_default_report {
                  break;
              case QUIZ_REPORT_ATTEMPTS_STUDENTS_WITH:
                  // Show only students with attempts
-                $where = 'u.id IN (' .$allowedlist. ') AND qa.preview = 0 AND qa.id IS NOT NULL';
+                 list($allowed_usql, $allowed_params) = $DB->get_in_or_equal($allowedlist, SQL_PARAMS_NAMED, 'u0000');
+                 $params += $allowed_params;
+                $where = "u.id $allowed_usql AND qa.preview = 0 AND qa.id IS NOT NULL";
                  break;
              case QUIZ_REPORT_ATTEMPTS_STUDENTS_WITH_NO:
                  // Show only students without attempts
-                $where = 'u.id IN (' .$allowedlist. ') AND qa.id IS NULL';
+                 list($allowed_usql, $allowed_params) = $DB->get_in_or_equal($allowedlist, SQL_PARAMS_NAMED, 'u0000');
+                 $params += $allowed_params;
+                $where = "u.id $allowed_usql AND qa.id IS NULL";
                  break;
              case QUIZ_REPORT_ATTEMPTS_ALL_STUDENTS:
                  // Show all students with or without attempts
-                $where = 'u.id IN (' .$allowedlist. ') AND (qa.preview = 0 OR qa.preview IS NULL)';
+                 list($allowed_usql, $allowed_params) = $DB->get_in_or_equal($allowedlist, SQL_PARAMS_NAMED, 'u0000');
+                 $params += $allowed_params;
+                $where = "u.id $allowed_usql AND (qa.preview = 0 OR qa.preview IS NULL)";
                  break;
          }
-        $table->set_count_sql("SELECT COUNT(1) FROM $from WHERE $where");
+
+        $table->set_count_sql("SELECT COUNT(1) FROM $from WHERE $where", $params);
 
         // Add table joins so we can sort by question grade
         // unfortunately can't join all tables necessary to fetch all grades
@@ -208,8 +218,9 @@ class quiz_report extends quiz_default_report {
                     if (preg_match('/^qsgrade([0-9]+)/', $sortpart, $matches)){
                         $qid = intval($matches[1]);
                         $fields .=  ", qs$qid.grade AS qsgrade$qid, qs$qid.event AS qsevent$qid, qs$qid.id AS qsid$qid";
-                        $from .= "LEFT JOIN {$CFG->prefix}question_sessions qns$qid ON qns$qid.attemptid = qa.uniqueid AND qns$qid.questionid = $qid ";
-                        $from .=  "LEFT JOIN  {$CFG->prefix}question_states qs$qid ON qs$qid.id = qns$qid.newgraded ";
+                        $from .= "LEFT JOIN {question_sessions} qns$qid ON qns$qid.attemptid = qa.uniqueid AND qns$qid.questionid = :qid ";
+                        $from .=  "LEFT JOIN  {question_states} qs$qid ON qs$qid.id = qns$qid.newgraded ";
+                        $params['qid'] = $qid;
                     } else {
                         $newsort[] = $sortpart;
                     }
@@ -217,18 +228,18 @@ class quiz_report extends quiz_default_report {
                 $select .= ' ';
             }
         }
-        
-        $table->set_sql($fields, $from, $where);
+
+        $table->set_sql($fields, $from, $where, $params);
         // Define table columns
         $columns = array();
         $headers = array();
-         
- 
+
+
         if (!$table->is_downloading() && $candelete) {
             $columns[]= 'checkbox';
             $headers[]= NULL;
         }
-        
+
         if (!$table->is_downloading() && $CFG->grade_report_showuserimage) {
             $columns[]= 'picture';
             $headers[]= '';
@@ -242,18 +253,18 @@ class quiz_report extends quiz_default_report {
             $columns[]= 'firstname';
             $headers[]= get_string('firstname');
          }
- 
+
         if ($CFG->grade_report_showuseridnumber) {
             $columns[]= 'idnumber';
             $headers[]= get_string('idnumber');
         }
-        
+
         $columns[]= 'timestart';
         $headers[]= get_string('startedon', 'quiz');
 
         $columns[]= 'timefinish';
         $headers[]= get_string('timecompleted','quiz');
- 
+
         $columns[]= 'duration';
         $headers[]= get_string('attemptduration', 'quiz');
 
@@ -264,21 +275,21 @@ class quiz_report extends quiz_default_report {
                 $headers[] = '#'.$question->number;
              }
         }
- 
+
         if ($showgrades) {
             $columns[] = 'sumgrades';
             $headers[] = get_string('grade', 'quiz').'/'.$quiz->grade;
          }
- 
+
         if ($hasfeedback) {
             $columns[] = 'feedbacktext';
             $headers[] = get_string('feedback', 'quiz');
          }
-         
+
         $table->define_columns($columns);
         $table->define_headers($headers);
         $table->sortable(true, 'uniqueid');
-        
+
         // Set up the table
         $table->define_baseurl($reporturl->out(false, $displayoptions));
 
@@ -287,7 +298,7 @@ class quiz_report extends quiz_default_report {
         $table->column_suppress('picture');
         $table->column_suppress('fullname');
         $table->column_suppress('idnumber');
-        
+
         $table->no_sorting('feedbacktext');
 
         $table->column_class('picture', 'picture');
@@ -299,7 +310,7 @@ class quiz_report extends quiz_default_report {
         $table->set_attribute('id', 'attempts');
 
         $table->out($pagesize, true);
-        
+
         if (!$table->is_downloading()) {
             if (count($table->totalrows)){
                  $imageurl = $CFG->wwwroot.'/mod/quiz/report/overview/overviewgraph.php?id='.$quiz->id;
diff --git a/mod/quiz/report/regrade/report.php b/mod/quiz/report/regrade/report.php
index 8f00b09cbc..6dc29b46ce 100644
--- a/mod/quiz/report/regrade/report.php
+++ b/mod/quiz/report/regrade/report.php
@@ -6,7 +6,7 @@ require_once($CFG->libdir.'/tablelib.php');
 class quiz_report extends quiz_default_report {
 
     function display($quiz, $cm, $course) {
-        global $CFG;
+        global $CFG, $DB;
 
         // Print header
         $this->print_header_and_tabs($cm, $course, $quiz, $reportmode="regrade");
@@ -19,18 +19,18 @@ class quiz_report extends quiz_default_report {
         }
 
         // Fetch all attempts
-        if (!$attempts = get_records_select('quiz_attempts', "quiz = '$quiz->id' AND preview = 0")) {
+        if (!$attempts = $DB->get_records_select('quiz_attempts', "quiz = ? AND preview = 0", array($quiz->id))) {
             print_heading(get_string('noattempts', 'quiz'));
             return true;
         }
 
         // Fetch all questions
-        $sql = "SELECT q.*, i.grade AS maxgrade FROM {$CFG->prefix}question q,
-                                         {$CFG->prefix}quiz_question_instances i
-                WHERE i.quiz = $quiz->id
+        $sql = "SELECT q.*, i.grade AS maxgrade FROM {question} q,
+                                         {quiz_question_instances} i
+                WHERE i.quiz = ?
                 AND i.question = q.id";
 
-        if (! $questions = get_records_sql($sql)) {
+        if (! $questions = $DB->get_records_sql($sql, array($quiz->id))) {
             print_error("Failed to get questions for regrading!");
         }
         get_question_options($questions);
@@ -65,17 +65,17 @@ class quiz_report extends quiz_default_report {
             $sumgrades = 0;
             $questionids = explode(',', quiz_questions_in_quiz($attempt->layout));
             foreach($questionids as $questionid) {
-                $lastgradedid = get_field('question_sessions', 'newgraded', 'attemptid', $attempt->uniqueid, 'questionid', $questionid);
-                $sumgrades += get_field('question_states', 'grade', 'id', $lastgradedid);
+                $lastgradedid = $DB->get_field('question_sessions', 'newgraded', array('attemptid' => $attempt->uniqueid, 'questionid' => $questionid));
+                $sumgrades += $DB->get_field('question_states', 'grade', array('id' => $lastgradedid));
             }
             if ($attempt->sumgrades != $sumgrades) {
                 $attemptschanged++;
-                set_field('quiz_attempts', 'sumgrades', $sumgrades, 'id', $attempt->id);
+                $DB->set_field('quiz_attempts', 'sumgrades', $sumgrades, array('id' => $attempt->id));
             }
         }
 
         // Update the overall quiz grades
-        if ($grades = get_records('quiz_grades', 'quiz', $quiz->id)) {
+        if ($grades = $DB->get_records('quiz_grades', array('quiz' => $quiz->id))) {
             foreach($grades as $grade) {
                 quiz_save_best_grade($quiz, $grade->userid);
             }
diff --git a/mod/quiz/report/reportlib.php b/mod/quiz/report/reportlib.php
index f6a65c8d9d..33d89a940f 100644
--- a/mod/quiz/report/reportlib.php
+++ b/mod/quiz/report/reportlib.php
@@ -7,20 +7,20 @@ define('QUIZ_REPORT_ATTEMPTS_STUDENTS_WITH_NO', 1);
 define('QUIZ_REPORT_ATTEMPTS_STUDENTS_WITH', 2);
 define('QUIZ_REPORT_ATTEMPTS_ALL_STUDENTS', 3);
 /**
- * Get newest graded state or newest state for a number of attempts. Pass in the 
+ * Get newest graded state or newest state for a number of attempts. Pass in the
  * uniqueid field from quiz_attempt table not the id. Use question_state_is_graded
  * function to check that the question is actually graded.
  */
 function quiz_get_newgraded_states($attemptids, $idxattemptq = true, $fields='qs.*'){
-    global $CFG;
+    global $CFG, $DB;
     if ($attemptids){
-        $attemptidlist = join($attemptids, ',');
+        list($usql, $params) = $DB->get_in_or_equal($attemptids);
         $gradedstatesql = "SELECT $fields FROM " .
-                "{$CFG->prefix}question_sessions qns, " .
-                "{$CFG->prefix}question_states qs " .
-                "WHERE qns.attemptid IN ($attemptidlist) AND " .
+                "{question_sessions} qns, " .
+                "{question_states} qs " .
+                "WHERE qns.attemptid $usql AND " .
                 "qns.newgraded = qs.id";
-        $gradedstates = get_records_sql($gradedstatesql);
+        $gradedstates = $DB->get_records_sql($gradedstatesql, $params);
         if ($idxattemptq){
             $gradedstatesbyattempt = array();
             foreach ($gradedstates as $gradedstate){
@@ -40,36 +40,44 @@ function quiz_get_newgraded_states($attemptids, $idxattemptq = true, $fields='qs
 
 function quiz_get_average_grade_for_questions($quiz, $userids){
     global $CFG, $DB;
-    $qmfilter = quiz_report_qm_filter_subselect($quiz, 'qa.userid');
-    $questionavgssql = "SELECT qs.question, AVG(qs.grade) FROM " .
-            "{$CFG->prefix}question_sessions qns, " .
-            "{$CFG->prefix}quiz_attempts qa, " .
-            "{$CFG->prefix}question_states qs " .
-            "WHERE qns.attemptid = qa.uniqueid AND " .
-            "qa.quiz = ? AND " .
-            ($qmfilter?$qmfilter.' AND ':'').
-            "qa.userid IN ({$userids}) AND " .
-            "qs.event IN (".QUESTION_EVENTS_GRADED.") AND ".
-            "qns.newgraded = qs.id GROUP BY qs.question";
-    return $DB->get_records_sql_menu($questionavgssql, array($quiz->id));
+    list($qmfilter, $params) = quiz_report_qm_filter_subselect($quiz, 'qa.userid'); //NAMED PARAMS!
+    $params['quizid2'] = $quiz->id;
+    list($usql, $u_params) = $DB->get_in_or_equal(explode(',', $userids), SQL_PARAMS_NAMED, 'u0000');
+    $params += $u_params;
+    $questionavgssql = "SELECT qs.question, AVG(qs.grade) FROM
+                        {question_sessions} qns,
+                        {quiz_attempts} qa,
+                        {question_states} qs
+                        WHERE qns.attemptid = qa.uniqueid AND " .
+                        ($qmfilter?$qmfilter.' AND ':'') . "
+                        qa.quiz = :quizid2 AND
+                        qa.userid $usql AND
+                        qs.event IN (".QUESTION_EVENTS_GRADED.") AND
+                        qns.newgraded = qs.id GROUP BY qs.question";
+    return $DB->get_records_sql_menu($questionavgssql, $params);
 }
 
 function quiz_get_total_qas_graded_and_ungraded($quiz, $questionids, $userids){
-    global $CFG;
-    $sql = "SELECT qs.question, COUNT(1) AS totalattempts, " .
-            "SUM(qs.event IN (".QUESTION_EVENTS_GRADED.")) AS gradedattempts " .
-            "FROM " .
-            "{$CFG->prefix}quiz_attempts qa, " .
-            "{$CFG->prefix}question_sessions qns, " .
-            "{$CFG->prefix}question_states qs " .
-            "WHERE " .
-            "qa.quiz = {$quiz->id} AND " .
-            "qa.userid IN ({$userids}) AND " .
-            "qns.attemptid = qa.uniqueid AND " .
-            "qns.newgraded = qs.id AND " .
-            "qs.question IN ({$questionids}) " .
-            "GROUP BY qs.question";
-    return get_records_sql($sql);
+    global $CFG, $DB;
+    $params = array($quiz->id);
+    list($u_sql, $u_params) = $DB->get_in_or_equal(explode(',', $userids));
+    list($q_sql, $q_params) = $DB->get_in_or_equal(explode(',', $questionids));
+
+    $params = array_merge($params, $u_params, $q_params);
+    $sql = "SELECT qs.question, COUNT(1) AS totalattempts,
+            SUM(qs.event IN (".QUESTION_EVENTS_GRADED.")) AS gradedattempts
+            FROM
+            {quiz_attempts} qa,
+            {question_sessions} qns,
+            {question_states} qs
+            WHERE
+            qa.quiz = ? AND
+            qa.userid $u_sql AND
+            qns.attemptid = qa.uniqueid AND
+            qns.newgraded = qs.id AND
+            qs.question $q_sql
+            GROUP BY qs.question";
+    return $DB->get_records_sql($sql, $params);
 }
 
 function quiz_format_average_grade_for_questions($avggradebyq, $questions, $quiz, $download){
@@ -99,20 +107,22 @@ function quiz_format_average_grade_for_questions($avggradebyq, $questions, $quiz
  * - Add grade from quiz_questions_instance
  */
 function quiz_report_load_questions($quiz){
-    global $CFG;
+    global $CFG, $DB;
     $questionlist = quiz_questions_in_quiz($quiz->questions);
-    //In fact in most cases the id IN $questionlist below is redundant 
+    //In fact in most cases the id IN $questionlist below is redundant
     //since we are also doing a JOIN on the qqi table. But will leave it in
     //since this double check will probably do no harm.
-    if (!$questions = get_records_sql("SELECT q.*, qqi.grade " .
-            "FROM {$CFG->prefix}question q, " .
-            "{$CFG->prefix}quiz_question_instances qqi " .
-            "WHERE q.id IN ($questionlist) AND " .
-            "qqi.question = q.id AND " .
-            "qqi.quiz =".$quiz->id)) {
+    list($usql, $params) = $DB->get_in_or_equal(explode(',', $questionlist));
+    $params[] = $quiz->id;
+    if (!$questions = $DB->get_records_sql("SELECT q.*, qqi.grade
+            FROM {question} q,
+            {quiz_question_instances} qqi
+            WHERE q.id $usql AND
+            qqi.question = q.id AND
+            qqi.quiz = ?", $params)) {
         print_error('No questions found');
     }
-    //Now we have an array of questions from a quiz we work out there question nos and remove 
+    //Now we have an array of questions from a quiz we work out there question nos and remove
     //questions with zero length ie. description questions etc.
     //also put questions in order.
     $number = 1;
@@ -130,7 +140,7 @@ function quiz_report_load_questions($quiz){
 }
 /**
  * Given the quiz grading method return sub select sql to find the id of the
- * one attempt that will be graded for each user. Or return 
+ * one attempt that will be graded for each user. Or return
  * empty string if all attempts contribute to final grade.
  */
 function quiz_report_qm_filter_subselect($quiz, $useridsql = 'u.id'){
@@ -153,31 +163,36 @@ function quiz_report_qm_filter_subselect($quiz, $useridsql = 'u.id'){
         $qmorderby = 'timestart DESC';
         break;
     }
+
+    $params = array();
     if ($qmfilterattempts){
-        $qmsubselect = "(SELECT id FROM {$CFG->prefix}quiz_attempts " .
-                "WHERE quiz = {$quiz->id} AND $useridsql = userid " .
+        $qmsubselect = "(SELECT id FROM {quiz_attempts} " .
+                "WHERE quiz = :quizid1 AND $useridsql = userid " .
                 "ORDER BY $qmorderby LIMIT 1)=qa.id";
+        $params['quizid1'] = $quiz->id;
     } else {
         $qmsubselect = '';
     }
-    return $qmsubselect;
+    return array($qmsubselect, $params);
 }
 
 function quiz_report_grade_bands($bandwidth, $bands, $quizid, $useridlist){
     global $CFG, $DB;
+    list($usql, $params) = $DB->get_in_or_equal(explode(',', $useridlist));
     $sql = "SELECT
         FLOOR(qg.grade/$bandwidth) AS band,
         COUNT(1) AS num
     FROM
         {quiz_grades} qg,  {quiz} q
-    WHERE qg.quiz = q.id AND qg.quiz = ? AND qg.userid IN ($useridlist)
+    WHERE qg.quiz = q.id AND qg.userid $usql AND qg.quiz = ?
     GROUP BY band
     ORDER BY band";
-    $data = $DB->get_records_sql_menu($sql, array($quizid));
+    $params[] = $quiz->id;
+    $data = $DB->get_records_sql_menu($sql, $params);
     //need to create array elements with values 0 at indexes where there is no element
     $data =  $data + array_fill(0, $bands+1, 0);
     ksort($data);
-    //place the maximum (prefect grade) into the last band i.e. make last 
+    //place the maximum (prefect grade) into the last band i.e. make last
     //band for example 9 <= g <=10 (where 10 is the perfect grade) rather than
     //just 9 <= g <10.
     $data[$bands-1] += $data[$bands];
@@ -207,9 +222,10 @@ function quiz_report_highlighting_grading_method($quiz, $qmsubselect, $qmfilter)
  * @return string the comment that corresponds to this grade (empty string if there is not one.
  */
 function quiz_report_feedback_for_grade($grade, $quizid) {
+    global $DB;
     static $feedbackcache = array();
     if (!isset($feedbackcache[$quizid])){
-        $feedbackcache[$quizid] = get_records('quiz_feedback', 'quizid', $quizid);
+        $feedbackcache[$quizid] = $DB->get_records('quiz_feedback', array('quizid' => $quizid));
     }
     $feedbacks = $feedbackcache[$quizid];
     $feedbacktext = '';
diff --git a/mod/quiz/restorelibpre15.php b/mod/quiz/restorelibpre15.php
index c34d279fe6..fcb5a6ff5f 100644
--- a/mod/quiz/restorelibpre15.php
+++ b/mod/quiz/restorelibpre15.php
@@ -124,7 +124,7 @@
                 $newid = $catfound;
             } else {
                 if (!$quiz_cat->stamp) {
-                    $quiz_cat->stamp = make_unique_id_code();   
+                    $quiz_cat->stamp = make_unique_id_code();
                 }
                 $newid = $DB->insert_record ("question_categories",$quiz_cat);
             }
@@ -484,7 +484,7 @@
             //Only if there aren't restrictions or there are restriction concordance
             if (empty($restrictto) || (!empty($restrictto) && $shortanswer->answers == $restrictto)) {
                 $newid = $DB->insert_record ("question_shortanswer",$shortanswer);
-            } 
+            }
 
             //Do some output
             if (($i+1) % 50 == 0) {
@@ -1012,7 +1012,7 @@
             if ($newid) {
                 $answersdb = $DB->get_records_list('question_answers','id', explode(',',$multianswer->answers));
                 foreach ($answersdb as $answerdb) {
-                    set_field('question_answers','question',$newid,'id',$answerdb->id);
+                    $DB->set_field('question_answers','question',$newid,array('id' =>$answerdb->id));
                 }
             }
 
@@ -1034,12 +1034,12 @@
         //Everything is created, just going to create the multianswer record
         if ($status) {
             ksort($createdquestions);
-           
+
             $multianswerdb = new object;
             $multianswerdb->question = $parentquestion->id;
             $multianswerdb->sequence = implode(",",$createdquestions);
             $mid = $DB->insert_record('question_multianswer', $multianswerdb);
-  
+
             if (!$mid) {
                 $status = false;
             }
@@ -1184,7 +1184,7 @@
             $dataset_item->value = backup_todb($di_info['#']['VALUE']['0']['#']);
 
             //The structure is equal to the db, so insert the question_dataset_items
-            $newid = $DB-insert_record ("question_dataset_items",$dataset_item);
+            $newid = $DB->insert_record ("question_dataset_items",$dataset_item);
 
             if (!$newid) {
                 $status = false;
@@ -1210,7 +1210,7 @@
             //if necessary, write to restorelog and adjust date/time fields
             if ($restore->course_startdateoffset) {
                 restore_log_date_changes('Quiz', $restore, $info['MOD']['#'], array('TIMEOPEN', 'TIMECLOSE'));
-            }            
+            }
             //traverse_xmlize($info);                                                                     //Debug
             //print_object ($GLOBALS['traverse_array']);                                                  //Debug
             //$GLOBALS['traverse_array']="";                                                              //Debug
@@ -1839,7 +1839,7 @@
                 $wtm = new WikiToMarkdown();
                 $record->questiontext = $wtm->convert($record->questiontext, $restore->course_id);
                 $record->questiontextformat = FORMAT_MARKDOWN;
-                $status = $DB->update_record('question', addslashes_object($record));
+                $status = $DB->update_record('question', $record);
                 //Do some output
                 $i++;
                 if (($i+1) % 1 == 0) {
diff --git a/mod/quiz/review.php b/mod/quiz/review.php
index d61e089c33..185706f9ee 100644
--- a/mod/quiz/review.php
+++ b/mod/quiz/review.php
@@ -20,10 +20,10 @@
     if (!$attempt = quiz_load_attempt($attemptid)) {
         print_error("No such attempt ID exists");
     }
-    if (! $quiz = get_record("quiz", "id", $attempt->quiz)) {
+    if (! $quiz = $DB->get_record('quiz', array('id' => $attempt->quiz))) {
         print_error("The quiz with id $attempt->quiz belonging to attempt $attempt is missing");
     }
-    if (! $course = get_record("course", "id", $quiz->course)) {
+    if (! $course = $DB->get_record('course', array('id' => $quiz->course))) {
         print_error("The course with id $quiz->course that the quiz with id $quiz->id belongs to is missing");
     }
     if (! $cm = get_coursemodule_from_instance("quiz", $quiz->id, $course->id)) {
@@ -151,14 +151,14 @@
 /// an array, then later we only output the table if there are any rows to show.
     $rows = array();
     if ($attempt->userid <> $USER->id) {
-        $student = get_record('user', 'id', $attempt->userid);
+        $student = $DB->get_record('user', array('id' => $attempt->userid));
         $picture = print_user_picture($student, $course->id, $student->picture, false, true);
         $rows[] = '<tr><th scope="row" class="cell">' . $picture . '</th><td class="cell"><a href="' .
                 $CFG->wwwroot . '/user/view.php?id=' . $student->id . '&amp;course=' . $course->id . '">' .
                 fullname($student, true) . '</a></td></tr>';
     }
     if (has_capability('mod/quiz:viewreports', $context) &&
-            count($attempts = get_records_select('quiz_attempts', "quiz = '$quiz->id' AND userid = '$attempt->userid'", 'attempt ASC')) > 1) {
+            count($attempts = $DB->get_records_select('quiz_attempts', "quiz = ? AND userid = ?", array($quiz->id, $attempt->userid), 'attempt ASC')) > 1) {
     /// List of all this user's attempts for people who can see reports.
         $urloptions = '';
         if ($showall) {
diff --git a/mod/quiz/reviewquestion.php b/mod/quiz/reviewquestion.php
index aa1441bcb9..4ba52588d6 100644
--- a/mod/quiz/reviewquestion.php
+++ b/mod/quiz/reviewquestion.php
@@ -20,36 +20,36 @@
     $number = optional_param('number', 0, PARAM_INT);  // question number
 
     if ($stateid) {
-        if (! $state = get_record('question_states', 'id', $stateid)) {
+        if (! $state = $DB->get_record('question_states', array('id' => $stateid))) {
             print_error('Invalid state id');
         }
-        if (! $attempt = get_record('quiz_attempts', 'uniqueid', $state->attempt)) {
+        if (! $attempt = $DB->get_record('quiz_attempts', array('uniqueid' => $state->attempt))) {
             print_error('No such attempt ID exists');
         }
     } elseif ($attemptid) {
-        if (! $attempt = get_record('quiz_attempts', 'id', $attemptid)) {
+        if (! $attempt = $DB->get_record('quiz_attempts', array('id' => $attemptid))) {
             print_error('No such attempt ID exists');
         }
-        if (! $neweststateid = get_field('question_sessions', 'newest', 'attemptid', $attempt->uniqueid, 'questionid', $questionid)) {
+        if (! $neweststateid = $DB->get_field('question_sessions', 'newest', array('attemptid' => $attempt->uniqueid, 'questionid' => $questionid))) {
             // newest_state not set, probably because this is an old attempt from the old quiz module code
-            if (! $state = get_record('question_states', 'question', $questionid, 'attempt', $attempt->uniqueid)) {
+            if (! $state = $DB->get_record('question_states', array('question' => $questionid, 'attempt' => $attempt->uniqueid))) {
                 print_error('Invalid question id');
             }
         } else {
-            if (! $state = get_record('question_states', 'id', $neweststateid)) {
+            if (! $state = $DB->get_record('question_states', array('id' => $neweststateid))) {
                 print_error('Invalid state id');
             }
         }
     } else {
         print_error('Parameter missing');
     }
-    if (! $question = get_record('question', 'id', $state->question)) {
+    if (! $question = $DB->get_record('question', array('id' => $state->question))) {
         print_error('Question for this state is missing');
     }
-    if (! $quiz = get_record('quiz', 'id', $attempt->quiz)) {
+    if (! $quiz = $DB->get_record('quiz', array('id' => $attempt->quiz))) {
         print_error('Course module is incorrect');
     }
-    if (! $course = get_record('course', 'id', $quiz->course)) {
+    if (! $course = $DB->get_record('course', array('id' => $quiz->course))) {
         print_error('Course is misconfigured');
     }
     if (! $cm = get_coursemodule_from_instance('quiz', $quiz->id, $course->id)) {
@@ -94,7 +94,7 @@
 /// Print heading
     print_heading(format_string($question->name));
 
-    $question->maxgrade = get_field('quiz_question_instances', 'grade', 'quiz', $quiz->id, 'question', $question->id);
+    $question->maxgrade = $DB->get_field('quiz_question_instances', 'grade', array('quiz' => $quiz->id, 'question' => $question->id));
     // Some of the questions code is optimised to work with several questions
     // at once so it wants the question to be in an array.
     $key = $question->id;
@@ -104,7 +104,7 @@
         print_error("Unable to load questiontype specific question information");
     }
 
-    $session = get_record('question_sessions', 'attemptid', $attempt->uniqueid, 'questionid', $question->id);
+    $session = $DB->get_record('question_sessions', array('attemptid' => $attempt->uniqueid, 'questionid' => $question->id));
     $state->sumpenalty = $session->sumpenalty;
     $state->manualcomment = $session->manualcomment;
     restore_question_state($question, $state);
@@ -118,13 +118,14 @@
     $table->align  = array("right", "left");
     if ($attempt->userid <> $USER->id) {
         // Print user picture and name
-        $student = get_record('user', 'id', $attempt->userid);
+        $student = $DB->get_record('user', array('id' => $attempt->userid));
         $picture = print_user_picture($student, $course->id, $student->picture, false, true);
         $table->data[] = array($picture, fullname($student, true));
     }
     // print quiz name
     $table->data[] = array(get_string('modulename', 'quiz').':', format_string($quiz->name));
-    if (has_capability('mod/quiz:viewreports', $context) and count($attempts = get_records_select('quiz_attempts', "quiz = '$quiz->id' AND userid = '$attempt->userid'", 'attempt ASC')) > 1) {
+    if (has_capability('mod/quiz:viewreports', $context) and
+            count($attempts = $DB->get_records_select('quiz_attempts', "quiz = ? AND userid =?", 'attempt ASC', array($quiz->id, $attempt->userid))) > 1) {
         // print list of attempts
         $attemptlist = '';
         foreach ($attempts as $at) {
diff --git a/mod/quiz/view.php b/mod/quiz/view.php
index ff637a3d8f..87a6176723 100644
--- a/mod/quiz/view.php
+++ b/mod/quiz/view.php
@@ -15,17 +15,17 @@
         if (! $cm = get_coursemodule_from_id('quiz', $id)) {
             print_error("There is no coursemodule with id $id");
         }
-        if (! $course = get_record("course", "id", $cm->course)) {
+        if (! $course = $DB->get_record('course', array('id' => $cm->course))) {
             print_error("Course is misconfigured");
         }
-        if (! $quiz = get_record("quiz", "id", $cm->instance)) {
+        if (! $quiz = $DB->get_record('quiz', array('id' => $cm->instance))) {
             print_error("The quiz with id $cm->instance corresponding to this coursemodule $id is missing");
         }
     } else {
-        if (! $quiz = get_record("quiz", "id", $q)) {
+        if (! $quiz = $DB->get_record('quiz', array('id' => $q))) {
             print_error("There is no quiz with id $q");
         }
-        if (! $course = get_record("course", "id", $quiz->course)) {
+        if (! $course = $DB->get_record('course', array('id' => $quiz->course))) {
             print_error("The course with id $quiz->course that the quiz with id $q belongs to is missing");
         }
         if (! $cm = get_coursemodule_from_instance("quiz", $quiz->id, $course->id)) {
diff --git a/question/type/questiontype.php b/question/type/questiontype.php
index 3e6882e85d..1269f768d1 100644
--- a/question/type/questiontype.php
+++ b/question/type/questiontype.php
@@ -880,7 +880,7 @@ class default_questiontype {
                 $states = $DB->get_records_select('question_states', "attempt = ? AND question = ? AND event > '0'", array($state->attempt, $question->id), 'seq_number ASC');
             } else {
                 // show only graded states
-                $states = $DB->get_records_select('question_states', "attempt = ? AND question = ? AND event IN (".QUESTION_EVENTS_GRADED.")", 'seq_number ASC', array($state->attempt, $question->id));
+                $states = $DB->get_records_select('question_states', "attempt = ? AND question = ? AND event IN (".QUESTION_EVENTS_GRADED.")", array($state->attempt, $question->id), 'seq_number ASC');
             }
             if (count($states) > 1) {
                 $strreviewquestion = get_string('reviewresponse', 'quiz');