I tried passing the db name as a parameter with '?', it doesn't always 
work.  Also, there shouldn't be any SQL injection issues here unless 
someone designed their system wrong (if a third party is allowed to pass 
the name of a db table into the open/create function, then they can do 
much worse than mangle or hide data in a sqlite database).

With regards to isinstance being better than type; it's only better if 
you want to support subclasses.  When writing the module, I had no 
interest in supporting subclasses (though supporting both str and buffer 
in 2.x, and bytes and memoryview in 3.x seems reasonable).