Use prepared statements for inserting songs into the database

Prepared statements are not only better for security but it also
sanitizes the inputs to ensure that special database characters such as a
single quote or double quotes or semi-colon

Both the dictionary and the sql statement is created in appendSong in db
then the dictionary and the insert statement are returned to insertSong.
insert_values is initialized to an empty dictionary to prevent errors of
the dictionary being referenced before it's used.

diff --git a/strmr/db.py b/strmr/db.py
index eff4c82..a457a1f 100644
--- a/strmr/db.py
+++ b/strmr/db.py
@@ -56,13 +56,14 @@ def enterSong(song):
        """
        c, conn = connect()
        sql = ""
+       insert_values = {}

        # checks if the song is already in the database by hash
        if checkHash(song):
-               sql = appendSong(song)
+               sql, insert_values = appendSong(song)

        # execute all the queries
-       c.execute(sql)
+       c.execute(sql, insert_values)

        conn.commit()

@@ -88,14 +89,33 @@ def appendSong(song):
                gets the sql query needed to enter the song into the database ba
                on the song object
        """
+       insert_values = {
+               'filename':song.filename,
+                'path':song.path,
+                'hash':str(song.hash),
+                'length':str(song.length),
+                'track':'/'.join(song.track),
+                'genre':'/'.join(song.genre),
+                'date':str(song.year),
+                'title':'/'.join(song.title),
+                'base':song.base,
+                'artist':'/'.join(song.artist),
+                'album':'/'.join(song.album)
+                }
        sql = "INSERT INTO SONGS (filename, path, hash, length, track, " \
-               + "genre, date, title, base, artist, album) VALUES ('" \
-               + song.filename + "', '" + song.path + "', '" + str(song.hash) \
-               + "', '" + str(song.length) + "', '" + '/'.join(song.track) + "'
-               + '/'.join(song.genre) + "', '" + str(song.year) + "', '" \
-               + '/'.join(song.title) + "', '" + song.base + "', '" \
-               + '/'.join(song.artist) + "', '" + '/'.join(song.album) + "');"
-       return sql
+               + "genre, date, title, base, artist, album) VALUES (" \
+               + ':filename, ' \
+               + ':path, ' \
+               + ':hash, ' \
+               + ':length, ' \
+               + ':track, ' \
+               + ':genre, ' \
+               + ':date, ' \
+               + ':title, ' \
+               + ':base, ' \
+               + ':artist, ' \
+               + ':album);'
+       return sql, insert_values

 def selectFromPlaylist(info):
        """