Is it safe to use string concatenation for dynamic SQL queries in Python with psycopg2

Question

I’m developing a Python application that interacts with a PostgreSQL database using psycopg2. In certain places, I’m building dynamic SQL queries by concatenating user input with query strings. 

For instance, I have something like this:

query = "SELECT * FROM users WHERE username = '" + user_input + "';"

I’ve heard that this approach might expose the application to SQL injection attacks, but I’m not sure how vulnerable it is in practice, especially since I’m using psycopg2. Is it generally unsafe to use string concatenation like this, and if so, what’s the best alternative to safely handle dynamic queries?