SQL Injection attacks on Python code

[deanhystad]

The "messing about" with placeholders is how you call the built in sanitizer function. It also does nice things like letting you to use SQL keywords in strings that you save in your database. Imagine a product database where the product description could not use all, any, as, from, in, ...