title: Python MySQL parameter queries for dynamic table names
body: <p>I want to query MySQL tables using my python program. However, the tables that I want to query are the ones whose names are passed in as variables (parameters).</p>
  
  <p>I tried something like this:</p>
  
  <pre><code>readTable_query = """SELECT * FROM %s"""
  readTable_cursor.execute(readTable_query, (table_name))
  </code></pre>
  
  <p>The problem with this is that the dynamically generated SQL query is putting the table name in quotes, i.e. instead of generating a query like "SELECT * FROM products", its generating a query like "SELECT * FROM 'products'". This is causing my program to fail and throws errors. Is there a workaround?</p>
  
  <p>I know I could concatenate the query but that would lead to a security risk of SQL injection.</p>
  
  <p>Full code for reference:</p>
  
  <pre><code>import MySQLdb
  
  table_name = 'products'
  
  db_connection = MySQLdb.connect(host,user,passwd,db)
  readTable_cursor = db_connection.cursor() 
  readTable_query = """SELECT * FROM %s"""
  readTable_cursor.execute(readTable_query, (table_name))
  </code></pre>