BUG SQL Injection in CsvBulkLoader (fixes #6227)

Diff should speak for itself, looks like this will have to be implemented in all supported branches. 
MINOR: Amended PHPUnit execution to work with PHPUnit 3.6