BUG: Dynamically created table names allow SQL injection
Working with the SQL code, I realized that the legacy code does not properly validate / escape passed in table and column names.

E.g.:

```
n [116]:

import pandas as pd
import pandas.io.sql as sql
import sqlite3

df = pd.DataFrame({'a':[1,2],'b':[2,3]})
con = sqlite3.connect(':memory:')
db = sql.SQLiteDatabase(con, 'sqlite')

t=sql.SQLiteTable('a; DELETE FROM contacts; INSERT INTO b', db, frame=df)

print t.insert_statement()
```

results in:

```
INSERT INTO a; DELETE FROM contacts; INSERT INTO b ([index],[a],[b]) VALUES (?,?,?)
```

This fixes the issues.

@jorisvandenbossche Is there anything else that should be done here?
 Also, @jorisvandenbossche --- this is now failing tests because of the rather brittle `_get_sqlite_column_type` inserted in #9109 . Is there a reason you are parsing the sql code directly instead of inserting the table and then reading out the column type from PRAGMA (as done by existing `_get_sqlite_column_type`)?
 @artemyk Hmm, I was first using the existing `_get_sqlite_column_type`, but then wrote that new function because I wanted to mimic the same test in the `TestSQLApi` (so just testing the type mapping that happens in `SQLTable` without the roundtrip to the actual database, so testing `_sqlalchemy_type`/`_sql_type_name` for sqlalchemy/fallback mode). But I agree it is rather brittle and not very good practice. 
You can easily update it so the tests pass (I assume changing the `'[]'` to `'""'` would be enough), but I can also change the test.
 @jorisvandenbossche I changed the test to `'""'` so that it passes now and this can be merged.  Personally I think a roundtrip to sqlite is better than a brittle test, so I would vote for changing it (I can do it in this PR if you'd like)
 @jorisvandenbossche Can we merge?
 @jorisvandenbossche  Now catching UnicodeError...
 @artemyk Thanks!
