When working directly with SQL instead of an ORM, how do you elegantly handle things like parameterizing table names or having flags that turns on or off filters?

In non-ORM codebasese I am seeing patterns where sql queries are "copy-pasted" together and I am not sure I like it.

Just imagine the following example had hundreds of lines of SQL and several optional filters, some of which could themselves be several lines long:

    def get_data(table1, table1, use_subset=True):
        if use_subset:
            filter_query = "AND column2="subset_value"
        else:
            filter_query = ""

        query = f"""
        SELECT 
          * 
        FROM
          {table1}
        JOIN
          {table2}
        WHERE
           column1="value"
           {filter_query}
        """