Comment by roelschroeven

You don't need an orm or some wrangling library to avoid sql injections. You just have to use parameterized queries. That's a bit cumbersome when using the bare C SQLite API, but in Python it's very easy.