BUG SQL Injection in CsvBulkLoader (fixes #6227)

Diff should speak for itself, looks like this will have to be implemented in all supported branches. 
Merge pull request #1308 from ss23/patch-10

BUG SQL Injection in CsvBulkLoader (fixes #6227)
Merge remote-tracking branch 'origin/2.4' into post-2.4
Including cms in post-2.4 builds for sapphire