title: Safe variable string for variable sqlite column (python)
body: <p>I have two questions.</p>
  
  <p>I understand that something like c.execute("INSERT INTO ? VALUES ...") is a big no no, since the ? is reserved for queries, not column names that could include anything from foreign or corrupt characters, injection to anything else. So here are my questions -</p>
  
  <ol>
  <li><p>Would the above example be safe if I could guarantee that the ? only contains real letters or real numbers from 0-9?</p></li>
  <li><p>if the answer to 1 is yes, then can I do this somehow by taking any user-given string, and rejecting it if it contains anything besides alphanumeric characters (0-9, a-z)? How would I do that?</p></li>
  </ol>
  
  <p>eg:</p>
  
  <pre><code>str="some potentially corrupt string from the user"
  
  If (not_alphanumeric(str)):
     pass
  else: 
     c.execute("INSERT INTO ? VALUES ...", (str,))
  </code></pre>
  
  <p>So in essence, if the answer to 1 is "yes", then how would I code not_alphanumeric for the conditionl test?</p>