Rewrite file-upload to use internal moodle lib instead of direct SQL injections