Switch to using SQL parameters rather than manual escaping for CSV to SQL

Currently, we escape all CSV values before inserting them into the query. A better and safer option would be to use parameterised queries. This would allow other database modules, which do not implement "escape_string", to be used for live import. The only problem is: how do we get the SQL back out again for the dump.

Allow DBMSs other than MySQL for live import for CSV to SQL

While the SQL dump is standard, live import is the main purpose of the tool. Aim: to allow other database systems, such as SQLite or Postgres to be imported to live.