user profile properties are stored in table UserProfiles serialized. In a module avoid accessing core tables directly, use BCL calls instead.

Here is a nice little sql stmt to start you off..  you just need to find which property id you are looking for ..

However, this is for direct sql access..   core code has methods built in or part of the membership provider..

SELECT    
  U.FirstName,
  U.LastName,
  U.Email,
  (SELECT PropertyValue FROM UserProfile WHERE
    UserProfile.UserID = U.UserID AND
    UserProfile.PropertyDefinitionID = 31) As PhoneNum
 FROM UserPortals AS UP
   RIGHT OUTER JOIN UserRoles  UR
   INNER JOIN Roles R ON UR.RoleID = R.RoleID
   RIGHT OUTER JOIN Users AS U ON UR.UserID = U.UserID
  ON UP.UserId = U.UserID
 WHERE ( UP.PortalId = 1)
  AND (R.RoleName = 'Registered Users')
 
 ORDER BY U.FirstName + ' ' + U.LastName