title: Protecting against SQL injection in python
body: <p>I have some code in Python that sets a char(80) value in an sqlite DB. </p>
  
  <p>The string is obtained directly from the user through a text input field and sent back to the server with a POST method in a JSON structure. </p>
  
  <p>On the server side I currently pass the string to a method calling the SQL UPDATE operation. </p>
  
  <p>It works, but I'm aware it is not safe at all. </p>
  
  <p>I expect that the client side is unsafe anyway, so any protection is to be put on the server side. What can I do to secure the UPDATE operation agains SQL injection ? </p>
  
  <p>A function that would "quote" the text so that it can't confuse the SQL parser is what I'm looking for. I expect such function exist but couldn't find it. </p>
  
  <p><strong>Edit:</strong>
  Here is my current code setting the char field name label:</p>
  
  <pre><code>def setLabel( self, userId, refId, label ):
      self._db.cursor().execute( """
          UPDATE items SET label = ? WHERE userId IS ? AND refId IS ?""", ( label, userId, refId) )
      self._db.commit()
  </code></pre>