Security: SQL injection risk in pandas Jupyter tutorial

[coderabbitai]

Description

The insert_values function in the pandas Jupyter tutorial (docs/integrate/pandas/tutorial-jupyter.md, lines 260-369) builds SQL INSERT statements using string concatenation without proper parameterization. This creates potential SQL injection vulnerabilities when users adapt the code for other data sources.

Problem

At line 289, ticker values are directly interpolated into the SQL string. If a ticker contained a single quote (e.g., O'REILLY), it would break the SQL statement and could allow injection attacks with untrusted data sources.

Suggested Solution

1. Add a warning note about the security implications for production use
2. Demonstrate the safer approach using parameterized queries with cursor.executemany()

Use parameterized queries instead of string concatenation to prevent SQL injection.

References

• Original discussion: pandas: Starter and Jupyter tutorial. Guidelines for efficient ingest. #297 (comment)
• File: docs/integrate/pandas/tutorial-jupyter.md

Requested by @amotl

[amotl]

That's a duplicate of GH-353?