title: Sqlalchemy When should literal_column or be used instead of bindparam?
body: <p>On the face of it, it seems that <code>bindparam</code> should generally be used to eliminate SQL injection. However, in what situations would it necessitate using <code>literal_column</code> instead of <code>bindparam</code> - and what measures should be taken to prevent SQL injection?</p>