cursor.execute must deal with query in bytes.

So decode the query, before escape the args.