###No, your code is vulnerable to SQL injection!

Use something like this to prevent it:

    cursor.execute("INSERT INTO table (state_int, turn_left, turn_right, move_forward) VALUES (?,?,?,?)",(database.records_table_name))

Note that you cannot (*or you shouldn't*) enter the table in like this:

    query = '''INSERT INTO %s...'''

 Ideally the table should be hard coded. **Under no circumstances** should it come from a user input of any kind. You can use a string similar to what you did for the table, but you'd better make 100% certain that a user can't change it somehow... See (**[Can I use parameters for the table name in sqlite3 ?][1]**) for more details.

The python pages quote say something like:

> Usually your SQL operations will need to use values from Python
> variables. You shouldn’t assemble your query using Python’s string
> operations because doing so is insecure; it makes your program
> vulnerable to an SQL injection attack

Using `cursor.execute` will stuff the value given, so that the argument could be as listed, and when you do a query on it, that is exactly what you will get out. [XKCD][2] explains this humorously as well.

[![enter image description here][3]][3]


  [1]: http://stackoverflow.com/questions/5870284/can-i-use-parameters-for-the-table-name-in-sqlite3
  [2]: http://xkcd.com/327/
  [3]: https://i.sstatic.net/Lgc3O.png