Does this generic query follow good OOP standards?
Your binding of parameters will help in preventing SQL injections.

You need to sanitize your data first though.
You need to treat everything that comes from a user (passed from the client machine) as 'dirty' and not allow it into your system before it's been 'cleaned'. Your first step would be to clean it - converting all HTML tags and special characters into their HTML entities htmlspecialchars() htmlentities() (well as long as HTML isn't allowed). This will help prevent cross-sight scripting (XSS). Typically then you would move on to validating the data - making sure it's in a format you expect. Then if it's not you return it to the user with an error.
This is also assuming that you've checked the user has permission to run this function, if relevant.