@techhat : execute with arguments is made for that, but only for value escaping, not for identifiers. This is the reason why I wrote quote_identifier. Identifiers (database names, columns, tables) do not follow the same escape policy. Quotes and double quotes are not escaped in identifiers, only \` are escaped.
You can see that in tests with db names like:
<pre>
testdb1 = 'tes.t\'"saltdb'
testdb2 = 't_st `(:=salt%b)'
testdb3 = 'test `(:=salteeb)'
</pre>
If you use a value escape on theses names you end up with wrong escaping and the SQL requests are wrong. And this becomes more complex on GRANT queries where % and _ characters may get escaped.

There is nothing in MySQLdb to manage the identifier escaping, except a not stating this should not be done with query arguments on execute :-). Bad escaping of db name could in fact be used to fool the SQL engine (forgeting to escape ` and instead escaping quotes).