Updating necessary data using just one function
You are vulnerable to SQL Injections. Even when you are using Prepared statements, doing It wrong will kill you.


$sql = "UPDATE users SET " . $data[0] . "=? WHERE username=?";



This makes you exposed to SQL injections because your function is not private. You should not allow "user" access to "critical" functions. make that function private and you should be good to go.

As soon as the user is allowed to set $data[0] you're screwed.