title: Creating postgres schemas using psycopg cur.execute
body: <p>My python application allows users to create schemas of their naming. I need a way to protect the application from sql injections.</p>
  
  <p>The SQL to be executed reads</p>
  
  <pre><code>CREATE SCHEMA schema_name AUTHORIZATION user_name;
  </code></pre>
  
  <p>The psycopg documentation (generally) recommends passing parameters to execute like so</p>
  
  <pre><code>conn = psycopg2.connect("dbname=test user=postgres")
  cur = conn.cursor()
  query = 'CREATE SCHEMA IF NOT EXISTS %s AUTHORIZATION %s;'
  params = ('schema_name', 'user_name')
  cur.execute(query, params)
  </code></pre>
  
  <p>But this results in a query with single quotes, which fails:</p>
  
  <pre><code>CREATE SCHEMA 'schema_name' AUTHORIZATION 'user_name';
  &gt; fail
  </code></pre>
  
  <p>Is there a way to remove the quotes, or should I just settle for stripping non-alphanumeric characters from the schema name and call it a day? The later seems kind of ugly, but should still work.</p>