Sqlite code leads to SQL injection vulnerability

[matclab]

See for example

bottle-cork/cork/sqlite_backend.py

Line 86 in 3690357

query = "SELECT * FROM %s WHERE %s='%s'" % (

We should instead use parametrized queries.