resumeIn brief
With sqlite3, parameters separate SQL text from input values. For example, execute('SELECT name FROM items WHERE id = ?', (item_id,)) supplies the identifier separately.
Useful to know
With sqlite3, parameters separate SQL text from input values. For example, execute('SELECT name FROM items WHERE id = ?', (item_id,)) supplies the identifier separately. [1]
Do not interpolate that value into the query string. A parameter does not replace arbitrary table or column names; dynamic identifiers need an explicit allowlist. After querying, handle the case where no record is returned.
Sources
For further detail and to check the information: