Fix MySQL specific quoting and CONCAT()

This fixes some MySQL-specific and erroneous quoting, so it now runs on other RDMS systems such as Microsoft SQL Server.  More specifically:

Bound parameters are not quoted, as the binding handles that (uses ?, not "?").

String literals use single quotes, double quotes are for identifiers (MySQL accepts backticks for identifiers):
http://www.savage.net.au/SQL/sql-2003-2.bnf.html#character%20string%20literal

Use Moodle's $DB->sql_concat rather than MySQL-specific CONCAT()