title: How to avoid SQL injection on query
body: <p>My SQL query construction in python code is:</p>
  
  <pre><code>query = '''
  SELECT {return_col} 
  FROM {table_name}   
  '''.format(colA, tableA)
  </code></pre>
  
  <p>When I run Bandit security tool, it says "Possible SQL injection vector through string-based query construction."</p>
  
  <p>How do I avoid it? </p>