title: Python MySQL statement to prevent SQL Injection
body: <p>I have the following code in python which is working fine:</p>
  
  <pre><code>import mysql.connector
  
  mydb = mysql.connector.connect(
      host="some_ip",
      port=3306,
      username="testuser",
      passwd="MyPassword",
      database="tested"
  )
  
  mycursor = mydb.cursor()
  sql = "INSERT INTO test_table(email, type, created_d)VALUES(%s,%s,%s)"
  val = (email,1,today)
  mycursor.execute(sql,val)
  mydb.commit()
  </code></pre>
  
  <p>Currently, the variable <code>email</code> is a user input. Is there any risk of SQL injection based on user input? If so, what are my choices of preventing SQL injection?</p>