Postgres from python

This snippet contains no validation whatsoever.

import psycopg2

connection = psycopg2.connect('dbname=product user=postgres host=127.0.0.1')
mark = connection.cursor()
query = """INSERT INTO PRODUCT(product_id, product, attribute) VALUES(%d, '%s', '%s')"""
statement = query % (1, "name", "attribute")
mark.execute(statement)
connection.commit()