A parameterized query separates SQL code from values: the query is sent with placeholders, and the values are passed separately and treated as data, never as SQL. It is the main defense against SQL injection.
Example
cur.execute("SELECT * FROM users WHERE name = %s", (nom,))