title: Compose dynamic SQL string with psycopg2
body: <p>I use <code>psycopg2</code> in python (2.7.10) to connect to a postgresql DB. The docs are pretty clear about composition of dynamic SQL statements:</p>
  
  <blockquote>
    <p>Never, <strong>never, NEVER</strong> use Python string concatenation (+) or string parameters interpolation (%) to pass variables to a SQL query string. Not even at gunpoint.</p>
  </blockquote>
  
  <p>In <code>psycopg2</code> version 2.7 there's the new <code>sql</code> module to do this string composition in a way that's safe against SQL injection. I nevertheless don't understand how to properly construct a statement like:</p>
  
  <pre><code>import psycopg2 as ps
  
  C = psycopg.connect(host='my_host', port=Port, database='My_DB')
  cur = C.cursor()
  schema = 'some_schema'
  table = 'some_table'
  SQL = cur.execute("SELECT * FROM "+schema+"."+table+";") # This is horribly wrong
  SQL = cur.execute("SELECT * FROM some_schema.some_table;") # That's what the result should be
  </code></pre>