How would you pass values from a Python script into a SQL query safely?

Why

Building SQL with an f-string or the % operator works until a value contains a quote. The psycopg documentation shows a name like O'Reilly breaking such a query, and explains that the same weakness lets anyone who controls the value change the query itself, which is SQL injection. In a lab setting the input may be a sample ID typed into a dashboard or read from a vendor file, so it is not trustworthy just because it is internal.

With psycopg the correct form is cur.execute("SELECT * FROM results WHERE sample_id = %s", (sample_id,)). The %s there is a placeholder, not Python formatting, and the second argument must be a sequence even for one value. The driver also converts Python types properly, so dates and decimals arrive as dates and decimals rather than strings. pandas read_sql accepts a params argument for the same reason.

Placeholders work for values only. A column or table name chosen at run time needs psycopg's sql.Identifier, or a fixed allow-list in code, which is the defense OWASP recommends when bind variables cannot be used. Parameterization also makes queries easier to log and test, because the SQL text stays constant.