title: How do I use prepared statements for "select from xxx where xxx" using python
body: <p>I have use a dict to store the condition, the number of keys and value in not fixed, such as</p>
  
  <pre><code>dict = {}
  dict['v1'] = 'abc'
  dict['v2'] = 123
  ...
  dict['vn'] = xxx
  </code></pre>
  
  <p>My sql format is  </p>
  
  <blockquote>
    <p>select * from tablename where v1 = 'abc' and v2 = 123 and ... vn = xxx</p>
  </blockquote>
  
  <p>I have tried to turn the sql like this first:</p>
  
  <blockquote>
    <p>sql = "select * from tablename where v1 = %s and v2 = %s and ... vn = %s"</p>
  </blockquote>
  
  <p>The format below can avoid sql injection, the question is that I dont know the number of values, how to write this  prepared statements. Thanks in advance.</p>
  
  <blockquote>
    <p>cursor.execute(sql, dict[v1], dict[v2], ..., dict[vn])</p>
  </blockquote>