However it's somewhat weakened by the possibility that some parts of the SQL string are resolved by the surrounding python context.