Q:

Python code trying to save excel data into database - error escaping special characters

Can someone please help me? I'm trying to read data from an excel file, save everything into a database file, then query the database and print all the name attributes. I'm using Python with sqlite3.
There are special caracters in the strings in my excel, so I'm trying to escape them. I don't need the special characters. I looked for the solution on google, but couldn't find out how to do it. I'm still a beginner at python and databases.
I got this error message:

When I saved all the data without the "re.escape", I got this error message:
OperationalError: near "6": syntax error
This is all the content of hamburgers.xlsx:

import re
import openpyxl
import sqlite3
from sqlite3 import Error

wb_ins = openpyxl.load_workbook("hamburgers.xlsx")
sheet_ins = wb_ins['Hamburger']
try:
    connection = sqlite3.connect("hamburger.db")
    print("hamburger.db created")    
except Error as e:
    print(e)

cursor = connection.cursor()
cursor.execute("DROP TABLE IF EXISTS hamburger")

sql = """CREATE TABLE hamburger (
    last_found Date,
    name char(10),
    stored number(4),
    hamb_id char(30) PRIMARY KEY);"""

cursor.execute(sql)

for row in sheet_ins.iter_rows(min_row=2, max_row=4):
    last_found = row[0].value
    name = re.escape(row[1].value)
    stored = row[2].value
    hamb_id= re.escape(row[3].value)

    cursor.execute("INSERT INTO hamburger VALUES('{lf}', '{n}', '{s}', '{hid}');".format(lf=last_found, n=name, s=stored, hid=hamb_id))

cursor.execute("SELECT name FROM hamburger")
name = cursor.fetchall()
print(name)

A:

Don't use re.escape and don't use string formatting with SQL queries, which is a (very) bad practice anyway since it exposes your code to SQL injections.
For example, if someone were to provide you an Excel sheet that contained a row where hamb_id is fake_hamb_id'); DROP TABLE hamburger; -- then your code would execute the query:
INSERT INTO hamburger VALUES('1', '2', '3', 'fake_hamb_id'); DROP TABLE hamburger; --');

Which in this case "just" deletes hamburgers from a DB, but it could just as easily do 
SELECT * FROM your_users_table;

Instead, use a parametrized query:
last_found = row[0].value
name = row[1].value
stored = row[2].value
hamb_id= row[3].value

cursor.execute("INSERT INTO hamburger VALUES(?, ?, ?, ?);",
               (last_found, name, stored, hamb_id))

