fix(security) cp2foss SQL injection vulnerability

• fix(security) cp2foss SQL injection vulnerability

Two SQL queries in the cp2foss utility insert variables into the SQL string, which creates an SQL injection vulnerability. This PR converts those queries into prepared statements using DbManager. SELECT \* has also been replaced with SELECT <fields> for efficiency.

removing unnecessary str_replace

commited by @timurphy as PR #665