Reject xPDOQuery conditions with SQL injection attempts

Encountering a semi-colon or UNION keyword outside of quoted strings in an xPDOQuery condition triggers an xPDOException and causes the entire xPDOQuery to be effectively invalidated by adding an always false condition to the WHERE clause: 2=1
Merge remote-tracking branch 'xpdo/develop' into develop

* xpdo/develop:
  Reject xPDOQuery conditions with SQL injection attempts