pydata/pandas — pull request #8986 by artemyk (2014-12-03 19:47:26+00:00)
Title: BUG: Dynamically created table names allow SQL injection

Working with the SQL code, I realized that the legacy code does not properly validate / escape passed in table and column names.

E.g.:

```
n [116]:

import pandas as pd
import pandas.io.sql as sql
import sqlite3

df = pd.DataFrame({'a':[1,2],'b':[2,3]})
con = sqlite3.connect(':memory:')
db = sql.SQLiteDatabase(con, 'sqlite')

t=sql.SQLiteTable('a; DELETE FROM contacts; INSERT INTO b', db, frame=df)

print t.insert_statement()
```
results in:
```
INSERT INTO a; DELETE FROM contacts; INSERT INTO b ([index],[a],[b]) VALUES (?,?,?)
```

This fixes the issues.