Just a little note: with mysql you don't have to put quotes around integers. So user_group = %d will do the job, no need to put quotes around it!

Futhermore, it looks quite safe to me.


Edit:
Wildhoney won the race to mention about the quotes. ;)