是否可以在SQLite查询中参数化表名和列名？

import sqlite3

def query_table_column(table_name, column_name):
    conn = sqlite3.connect('your_database.db')
    cursor = conn.cursor()

    # 输入验证和过滤，确保安全性
    if not is_valid_table_name(table_name) or not is_valid_column_name(column_name):
        raise ValueError('Invalid table name or column name')

    # 拼接查询语句
    query = f"SELECT {column_name} FROM {table_name}"

    # 执行查询
    cursor.execute(query)
    result = cursor.fetchall()

    conn.close()

    return result