Cursor.execute(sql) -> "TypeError: argument 1 must be str, not tuple" with 2 arguments in parameters

Question

I need to check wether the mail and the password (mdp) are correct when the user is logging. However, flask doesn't approve my code and tells me that I have an error :

cur.execute(sql) TypeError: argument 1 must be str, not tuple: TypeError: argument 1 must be str, not tuple

This is my code :

@app.route('/', methods=['GET','POST'])
def login():
    msg_error=""
    if flask.request.method=="POST" and "mail" in flask.request.form and "mdp" in flask.request.form:
        mail=flask.request.form["mail"]
        mdp=flask.request.form["mdp"]
        conn=sqlite3.connect(db)
        cur=conn.cursor()
        cur.execute(sql="SELECT * FROM Adherents WHERE Mail='?' AND Mdp ='?'",["mail"],["mdp"])
        adherent=cur.fetchone()
        if adherent:
            flask.session["log"]=True 
            flask.session["idAdherent"]=adherent["idAdherent"]
            flask.session["mail"]=adherent["mail"]
            flask.session["prenom"]=adherent["prenom"]
            flask.session["nom"]=adherent["nom"]
            flask.session["ecole"]=adherent["ecole"]
            return flask.redirect ("/home")
        else:
            msg_error="Il y a une erreur, veuillez réessayer!"
    return flask.render_template("login.html", msg=msg_error)

Does someone know why ?