Interpolating input into connection.execute allows arbitrary SQL execution.
Use exec_query with bind parameters or sanitize input before executing raw SQL.