SQLite table name parameter

Question

I'm trying to replace some of my string insertions with parameters. So I have this code that executes the query:

cursor.execute("DELETE FROM %s WHERE COL=%s" % ("tablename","column"))

I can replace it with

cursor.execute("DELETE FROM tablename WHERE COL=?" , ("column"))

But I want my tablename to be in a variable. How can I protect insertion of a variable for a table from sql injections?

Answer 1

If your goal is to make sure that the variable is the name of a valid table, you can get a list of table names using

SELECT name FROM sqlite_master WHERE type='table'

And then check to see if the variable from the config file matches one of the tables. This avoids having to hardcode a list of tables.