fix: use regex-based pyformat substitution in cursor.execute()

[james-willis]

Summary

• Replaces the raw operation % (parameters or {}) call in cursor.execute() with a regex-based _substitute_parameters() helper that only matches %(name)s pyformat tokens.
• Literal % characters in SQL (e.g. LIKE '%good%') are left untouched, even when parameters are provided. No %% escaping is needed.
• Unknown parameter keys now raise ProgrammingError with a clear message.
• Adds a PEP 249 compliance section to the README documenting the module-level globals (apilevel, threadsafety, paramstyle) and parameterized query usage with examples.

Test plan

18 new tests in tests/test_cursor.py across two classes:

TestCursorExecuteParameterSubstitution (11 tests) — end-to-end through cursor.execute():

• LIKE queries with % wildcards (leading, trailing, both sides, multiple clauses)
• parameters=None and parameters={} with percent-containing queries
• Named parameter substitution, multiple parameters
• LIKE wildcards combined with named parameters (no %% escaping)
• Unknown parameter key raises ProgrammingError

TestSubstituteParameters (7 tests) — unit tests for the helper directly:

• None/empty params return operation unchanged
• Named param substitution
• Literal % preserved alongside params
• Unknown key raises ProgrammingError
• Repeated param name substituted everywhere
• Bare %s (format-style) is not treated as a pyformat param

[salty-hambot]

Reviewed by Salty Hambot 🤖🧂

Fix works for the empty-params case but leaves a landmine for non-empty params with literal % — a comment noting the limitation and a negative regression test would make this much more defensible.

_{2 finding(s) posted.
💬 To request a re-review, comment @salty-hambot review}

[salty-hambot]

Reviewed by Salty Hambot 🤖🧂

The regex rewrite elegantly dodges the %-formatting trap, but str() substitution without quoting means every string parameter produces invalid SQL — and the README's own examples are broken by it.

_{2 finding(s) posted.
💬 To request a re-review, comment @salty-hambot review}

[salty-hambot]

Reviewed by Salty Hambot 🤖🧂

Looking good on the third pass — the quoting and regex rewrite are solid. One edge case left: float('inf') and float('nan') sneak through _quote_value and produce invalid SQL literals that'll blow up server-side.

_{1 finding(s) posted.
💬 To request a re-review, comment @salty-hambot review}

[notion-workspace]

Investigate and resolve issue with Mo's Gilbert building query

[sfishel18]

is there no third-party library we can use to render a parameterized sql statement?

[james-willis]

Not that I could find Simon