title: Fixing SQL Injection With _mysql
body: <p>I just found out that the way I am using _mysql is causing a major SQL Injection problem.</p>
  
  <p>My current code looks like:</p>
  
  <pre><code>db = _mysql.connect('', 'user', 'pass', 'db')
  query = """SELECT * FROM stuff WHERE thing="{0}" """.format(user_input)
  cur.query(query)
  </code></pre>
  
  <p>What am I doing wrong and how can I fix it so that it is safe?</p>
  
  <p>I have tried using _mysql.escape_string() but that still returns an SQL syntax error. </p>