I have a sql query I'm executing that I'm passing variables into. In the current context I'm passing the parameter values in as f strings, but this query is vulnerable to sql injection. I know there is a method to use a stored procedure and restrict permissions on the user executing the query. But is there a way to avoid having to go the stored procedure route and perhaps modify this function to be secure against SQL Injection?

```
I have the below query created to execute within a python app.

```

```
def sql_gen(tv, kv, join_kv, col_inst, val_inst, val_upd):
    sqlstmt =  f"""
  IF NOT EXISTS (
          SELECT *
          FROM {tv}
          WHERE {kv} = {join_kv}
          )
      INSERT {tv} (
      {col_inst}
      )
      VALUES (
      {val_inst}
      )
  ELSE
      UPDATE {tv}
      SET {val_upd}
      WHERE {kv} = {join_kv};
      """
    engine = create_engine(f"mssql+pymssql://{username}:{password}@{server}/{database}")
    connection = engine.raw_connection()
    cursor = connection.cursor()

    cursor.execute(sqlstmt)
    connection.commit()

    cursor.close()

```