title: Substituting column names in Python sqlite3 query
body: <p>I have a wide table in a sqlite3 database, and I wish to dynamically query certain columns in a Python script. I know that <a href="http://xkcd.com/327/" rel="nofollow">it's bad to inject parameters by string concatenation</a>, so I tried to use parameter substitution instead. </p>
  
  <p>I find that, when I use parameter substitution to supply a column name, I get unexpected results. A minimal example:</p>
  
  <pre><code>import sqlite3 as lite
  
  db = lite.connect("mre.sqlite")
  c = db.cursor()
  
  # Insert some dummy rows
  c.execute("CREATE TABLE trouble (value real)")
  c.execute("INSERT INTO trouble (value) VALUES (2)")
  c.execute("INSERT INTO trouble (value) VALUES (4)")
  db.commit()
  
  
  for row in c.execute("SELECT AVG(value) FROM trouble"):
      print row   # Returns 3
  
  for row in c.execute("SELECT AVG(:name) FROM trouble", {"name" : "value"}):
      print row   # Returns 0
  
  db.close()
  </code></pre>
  
  <p>Is there a better way to accomplish this than simply injecting a column name into a string and running it?</p>