Django & Postgres explicit SQL parameters escape

I need to construct a long SQL 开发者_如何学Pythonrequest to my database, but I'm not sure how can I escape parameters correctly

How can I explicitly escape parameters in SQL like cursor.execute() does?

Can you also give me an example what exactly this escaping have to do, so I can test it?

Is there any difference if you escape standard SQL request or database function call?

If you need to build your parameter list dynamically:

sql = "SELECT FROM foo WHERE bar='baz'"
param_list = []
for entry in loop_array:
    sql = sql + "AND " + entry.key + " = %s"
    param_list.append(entry.value)

cursor.execute(sql, param_list)