There're are some things to consider:
1st Prepare your query and use the proper prefix.
This prevents most tries to inject something into your DB.
Every built in table can get called simply by using
$wpdb->tablename. In your case that would be
$wpdb->posts. As you might know, there's the possibility to add a global named
$table_prefix to your
wp-config.php-file. So in case you got a custom table, you should use
prepare() - like you can read in nearly every Q/A over here. The function works similar to
printf/sprintf() in "plain" PHP and uses
%s to replace strings and
%d to replace digits (int).
$results = $wpdb->get_result( $wpdb->prepare(
SELECT meta_value AS autor
FROM $wpdb->posts, $wpdb->postmeta
WHERE post_status = 'publish'
AND meta_key = '%s'
GROUP BY meta_value
ORDER BY meta_value
2nd Use the proper internal API
On the one hand there's something called meta-query (read into this archive).
You can use filters like
$query->set( 'key', 'value' ) pairs for your main query and other filters like
posts_clauses or the "smaller"
posts_orderby to intercept the query string.
The last filter you can use to check on the query is the
post_results filter do to some manipulation/parsing to the resulting data.
You can read more about it in this answer.
3rd Don't query if you got a template tag to do the job for you
On the other hand there're functions like