title: Best way to inject a variable column retrieval list into an SQL query (via psycopg2 execution)
body: <p>I have a query as such:</p>
  <pre><code>SELECT_DATA = &quot;&quot;&quot;select *
                   from schema.table tb
                   order by tb.created_time
                   &quot;&quot;&quot;
  </code></pre>
  <p>However, instead of selecting for all the columns in this table, I want to retrieve by a specified column list that I supply via psycopg2 injection in Python. The supplied column list string would look like this:</p>
  <pre><code>'col1, col2, col3'
  </code></pre>
  <p>Simple enough, except I also need to append the table alias &quot;tb&quot; to the beginning of each column name, so it needs to look like:</p>
  <pre><code>'tb.col1, tb.col2, tb.col3'
  </code></pre>
  <p>The resulting query is therefore:</p>
  <pre><code>SELECT_DATA = &quot;&quot;&quot;select tb.col1, tb.col2, tb.col3
                   from schema.table tb
                   order by tb.created_time
                   &quot;&quot;&quot;
  </code></pre>
  <p>The most straightforward way I'm thinking in my head would be to parse the given string into a comma-separated list, append &quot;tb.&quot; to the beginning of each column name, then parse the list back to a string for injection. But that seems pretty messy and hard to follow, so I was wondering if there might a better way to handle this?</p>