Hi Petr
Although it could at first sight appears as sloppy use of optional_param() in most case the default PARAM_CLEAN is a valid option because the edit_calculatedsimple_form.php does not store in the database the values retrieved.
They will be further processed in the validation steps and other internal moodleform functions.
The edit_calculaledsimple_form.php is built progressively following the wild card parameters {x} the user defined in the answer text .
The other parameters necessary to specify the wild card values are added to the form progessively.
As an option I prefered that the display reflects the user typing as much as possible and I used the validation process to warn the user that the value is not valid (i.e. typin a , in a number ).
Using PARAM_CLEAN which either returns a number if there is a valid number or clean the text of any possible hack is a good option in most cases.
So the actual code will not create problems at the block level and given your CVS Hack is not even a real major bug.
In any case I willreview the code and add more specific optional_param PARAM on user input field items IFnecessary.
Sub-task
Closed
Major
temporary hacks in cvs