diff --git a/question/type/calculated/question.php b/question/type/calculated/question.php
index 43f92b6647c..d4a48726676 100644
--- a/question/type/calculated/question.php
+++ b/question/type/calculated/question.php
@@ -342,6 +342,10 @@ class qtype_calculated_variable_substituter {
      * @return float the computed result.
      */
     public function calculate($expression) {
+        // Make sure no malicious code is present in the expression. Refer MDL-46148 for details.
+        if ($error = qtype_calculated_find_formula_errors($expression)) {
+            throw new moodle_exception('illegalformulasyntax', 'qtype_calculated', '', $error);
+        }
         return $this->calculate_raw($this->substitute_values_for_eval($expression));
     }