BUG: Dynamically created table names allow SQL injection

Working with the SQL code, I realized that the legacy code does not properly validate / escape passed in table and column names.

E.g.:

```
n [116]:

import pandas as pd
import pandas.io.sql as sql
import sqlite3
 
df = pd.DataFrame({'a':[1,2],'b':[2,3]})
con = sqlite3.connect(':memory:')
db = sql.SQLiteDatabase(con, 'sqlite')
 
t=sql.SQLiteTable('a; DELETE FROM contacts; INSERT INTO b', db, frame=df)
 
print t.insert_statement()
```
results in:
```
INSERT INTO a; DELETE FROM contacts; INSERT INTO b ([index],[a],[b]) VALUES (?,?,?)
```

This fixes the issues.