The way you have implemented the constants.php file and are storing core table names does not meet Moodle coding guidelines and makes it very hard to review your code. You should not be using constants for table/column names and should be using the actual table name in the dml function - eg:
$DB->get_records(COURSE_TABLE_NAME
should be replaced with:
$DB->get_records('course'
There are a number of reasons this does not meet Moodle coding guidelines, but one of the biggest reasons is that it should be easy for a developer to review your code and look at your use of SQL and determine that no sql injection vulnerabilites are possible - the developer should not need to go looking for how and where you define constants.
This must be fixed prior to acceptance in the moodle.org plugins db and before a further review is undertaken.
The way you have implemented the constants.php file and are storing core table names does not meet Moodle coding guidelines and makes it very hard to review your code. You should not be using constants for table/column names and should be using the actual table name in the dml function - eg:
$DB->get_records(COURSE_TABLE_NAME
should be replaced with:
$DB->get_records('course'
There are a number of reasons this does not meet Moodle coding guidelines, but one of the biggest reasons is that it should be easy for a developer to review your code and look at your use of SQL and determine that no sql injection vulnerabilites are possible - the developer should not need to go looking for how and where you define constants.
This must be fixed prior to acceptance in the moodle.org plugins db and before a further review is undertaken.