title: How can I insert safely (sql injection) identifiers in a query using snowflake python connector?
body: <p>In order to avoid SQL injection attacks I want to use bind variables / query parameters, but those doesn't seem to work for identifiers (like a table name, or a user name) </p>
  
  <pre><code>import snowflake.connector
  import os
  def myfunc(username):
      with snowflake.connector.connect(user=os.environ['SF_USER'], password=os.environ['SF_PASSWORD'], account=os.environ['SF_ACCOUNT']) as ctx:
          cs = ctx.cursor().execute('''SHOW GRANTS TO USER %s''', (username))
          print(cs.rowcount)
          rint(cs.fetchone())
  myfunc('TEST2') # Raises a ProgrammingError: 001003 (42000): SQL compilation error: syntax error line1 at position 20 unexpected ''TEST2''
  </code></pre>
  
  <p>I guess in the above test <code>TEST2</code> is inserted as a literal <code>'TEST2`` and not as an identifier</code>"TEST2"`. </p>
  
  <p>If I can't use bind variables / query parameters for this, I guess I would need to construct the string myself  <code>f'''SHOW GRANTS TO USER {username}'''</code> but <strong>what options do I have to sanitize the input before the string interpolation</strong>? </p>
  
  <p>By the way, I know that instead of <code>SHOW GRANTS TO USER "&lt;username&gt;"</code> I could use <code>select * from "SNOWFLAKE"."ACCOUNT_USAGE"."GRANTS_TO_USERS" where deleted_on is null and grantee_name = '&lt;username2'</code> which avoid the problem since the in the latter query the username is used as a literal and not an identifier. But I found the <code>SNOWFLAKE.ACCOUNT_USAGE.GRANTS_TO_USERS</code> to be lagging (does NOT show the latest changes immediately, delayed by more that 20 minutes in my case). </p>
  
  <p>So what can I use to sanitize the values I'll use as identifiers to prevent SQL injection attacks?  </p>