aparently you are supposed to use DB-API’s parameter substitution