But again, if you can inject that into the source code, why can't you just do

  "SELECT {};".format(settings.SECRET_KEY)

Remember that the interpolation only works for string literals, you can't inject that from external input.