title: How to put parameterized sql query into variable and then execute in Python?
body: <p>I understand that the correct way to format a sql query in Python is like this:</p>
  
  <pre><code>cursor.execute("INSERT INTO table VALUES (%s, %s, %s)", var1, var2, var3)
  </code></pre>
  
  <p>so that it prevents sql injection. My question is if there is a way to put the query in a variable and then execute it? I have tried the example below but receive an error. Is it possible to do this?</p>
  
  <pre><code>sql="INSERT INTO table VALUES (%s, %s, %s)", var1, var2, var3
  cursor.execute(sql)
  </code></pre>