In fact, your query is right except for the typo: your filter is excluding all records: you should change the <= for >= and vice versa:
qry = DBSession.query(User).filter(
and_(User.birthday <= '1988-01-17', User.birthday >= '1985-01-17'))
# or same:
qry = DBSession.query(User).filter(User.birthday <= '1988-01-17').\
filter(User.birthday >= '1985-01-17')
Also you can use between:
qry = DBSession.query(User).filter(User.birthday.between('1985-01-17', '1988-01-17'))