`.execute()` will handle the fact that these things are strings. No need to put quotation marks on the `%s` things.