columnList() properly escapes table names