title: Is further psycopg2 SQL injection mitigtation possible?
body: <p>I'm thinking about adding an additional layer of SQL injection mitigation in my usage of <code>psycopg2</code></p>
  <p>If <code>cursor.execute</code> is used properly and the parameters are passed like below this is not a concern.</p>
  <pre><code>cursor.execute(&quot;SELECT * FROM employees WHERE name = %s&quot;, (name,))
  </code></pre>
  <p>But I'm slightly worried about myself or another developer absentmindedly doing something like</p>
  <pre><code>cursor.execute(&quot;SELECT * FROM employees WHERE name = %s&quot; % (name))
  </code></pre>
  <p>which would of course open the door to someone submitting their name as <code>''; drop table employees;</code></p>
  <p>Since the second example contains a very common way of formatting a string in Python it's not outside the realm of possibility that someone could make such an error.</p>
  <p>I'm wondering if a method similar to <code>execute</code> exists that would restrict the number of queries or statements being executed in a call to <code>execute</code> to 1. If not, does <code>psycopg2</code> expose a SQL tokenizing method. If so I could write my own method that overrides execute and performs such a check before passing the query to the real execute. Or any other suggestions appreciated.</p>