code: def __preparequery(self, sql_query, columns):
          
          if columns:
              if "${columns}" not in sql_query:
                  raise TypeError("received columns but ${columns} not in query")
  
              escape = self.__methods[METHOD_ESCAPE]
  
              self.__col2idx_map = {}
              col_list = []
  
              for idx, col in enumerate(columns):
                  self.__col2idx_map[col] = idx
                  col_list.append(escape(col))
  
              return sql_query.replace("${columns}", ",".join(col_list))
          else:
              self.__col2idx_map = None
  
              return sql_query
docs: WARNING: You can't both pass a ${columns} literal to the
          underlying .execute() method and use the columns escaping,
          injection and symbolic access mechanism.
          WARNING: It is not recommended to SELECT *