In lots of places in the quiz code, we have code like

$mark = clean_param(str_replace(',', '.', $mark), PARAM_FLOAT);

This accepts input with either decimal point convetion, and so is more flexible than unformat_float. This seems to work more like how people expect. It only goes wrong if people type a thousand's separator, which it seems that they never do in the context of grades. In some multi-lingual areas, people do type the opposite , or . even though the Moodle language pack says that the other one is 'right'.

This str_repeat code, that is duplicated in many places now, should be moved into a helper function (I suggest unformat_float_tolerant in moodlelib.php next to unformat float.)

The implementation of clean_param_mark added to question/engine/lib.php by MDL-51090 is probably the best one to copy https://github.com/timhunt/moodle/compare/master...MDL-51090#diff-aa5175f8cb3369102d372984f5ee8965R914

Searching the code for [',', '.'] should find all the duplicate code that needs to be replaced by a call to this new function.