Sqlite query using string as parameter in python