Allow MySQLdb to take parameter placeholders

These allow values to be passed into SQL statements without interpolating them into the string, preventing possible SQL injection issues. For example:

```python
sql = """SELECT * FROM fpr_formatversion WHERE uuid='%s'""".format(uuid)
databaseInterface.queryAllSQL(sql)
```

Could be run as:

```python
sql = """SELECT * FROM fpr_formatversion WHERE uuid=%s"""
databaseInterface.queryAllSQL(sql, (uuid,))
```

Since the values are inserted here without string interpolation, there is no risk of quoting issues or SQL injection regardless of the contents of the values.
Good catch, updated to use `{name}`-style `.format` formatting which ignores `%s`.