DataFrame.query() could be vulnerable to SQL injections like attacks if the user doesn't know what they are doing
Currently DataFrame.query() takes a string to query a database in a way that's quite similar to how an SQL query reads data from a database. If a user writes code that uses pythons standard string replacement or that uses regex, the code is vunerable in a similar way to how SQL queries that are build with string replacement and regex are vulnerable.

Pythons [sqlite3 ](https://docs.python.org/2/library/sqlite3.html) writes in it's documentation:

```
# Never do this -- insecure!
symbol = 'RHAT'
c.execute("SELECT * FROM stocks WHERE symbol = '%s'" % symbol)

# Do this instead
t = ('RHAT',)
c.execute('SELECT * FROM stocks WHERE symbol=?', t)
```

I think it would be valuable to provide a similar API for DataFrame.query(). In most cases  DataFrame.query() likely will be used in scientific computing context where injection attacks aren't a concern but sooner or later someone will write code with DataFrame.query() where injection attacks are a concern. 
