pass string variable to sql query python