Use placeholders here. So everywhere you're using format substitutions use `%s` in place of `{0},{1},{2}` and push the corresponding value onto a list of placeholders. Return both the replace value and list of placeholders for execute. That way you can use the db driver to do the quoting and you don't have to worry about sql injection.