[FIX] hr_holidays: proper parameter passing syntax for raw SQL

This instance was not actually exploitable for
SQL injection as it is not callable directly
via RPC and guarded by other queries when indirectly
called. Still plain awful.
[FIX] document: replace raw SQL constraint with bad parameter passing with builtin check_recursion

This instance was not actually exploitable for
SQL injection as it is not callable directly
via RPC and guarded by other queries when indirectly
called. Still plain awful.