Parameterize SQL queries in Python to prevent SQL injection

import sqlite3

def get_users_by_name(name):
    """Fetch users safely using parameterized query."""
    conn = sqlite3.connect(':memory:')
    cursor = conn.cursor()
    
    # Create sample table and data
    cursor.execute('CREATE TABLE users (id INTEGER, name TEXT)')
    cursor.executemany('INSERT INTO users (name) VALUES (?)', 
                       [('Alice',), ('Bob',), ('Carol',)])
    
    # SAFE: Parameterized query prevents SQL injection
    cursor.execute('SELECT * FROM users WHERE name = ?', (name,))
    result = cursor.fetchall()
    
    conn.close()
    return result

if __name__ == "__main__":
    # Test with normal input
    print("Normal input:", get_users_by_name("Alice"))
    
    # Test with injection attempt - safely returns empty, no injection
    injection_attempt = "'; DROP TABLE users; --"
    print("Injection attempt:", get_users_by_name(injection_attempt))