python防止sql注入的两种方法

import MySQLdb
conn = MySQLdb.connect(host='localhost', user='root', passwd='', db='test')
param = 'aaa'

escape_param = MySQLdb.escape_string(param)
cur = conn.cursor()
cur.execute("select * form table where col="+escape_param+"")
cur.commit()
cur.close()