Home-grown web service
There are some big holes in your security 


Authenticate the data source. (Is it a legitimate source, username/password/etc)
Sanitize the user data.


Check $trackCols against a list of valid column names you are expecting, to stop me doing things like I have below.

$valid_cols = array('id', 'user', 'name');
foreach ($trackCols as $col) {
    if (!in_array($col, $valid_cols)) {
        die("Alert! Unexpected Column $col");
    }
}


PDO allows you to bind variables to the statement, and it will escape any dangerous data.
This will help stop people from creating attacks as I have below.

$sth = $dbh-&gt;prepare('SELECT name, colour, calories
    FROM fruit
    WHERE calories &lt; :calories AND colour = :colour');
$sth-&gt;bindParam(':calories', $calories, PDO::PARAM_INT);
$sth-&gt;bindParam(':colour', $colour, PDO::PARAM_STR, 12);
$sth-&gt;execute();


I have included a test script below (DO NOT RUN AGAINST YOUR LIVE DATABASE)

I have manufactured some bad json data so that it will execute a delete statement on the tracker table in your database. 

Obviously it won't work unless I get the table and column names correct, but as your code is now, if I try a dummy column name it will give me back an sql error message, which can help me to narrow it down.

Log the error message instead of returning them. This is an API, all the client end needs to know is that it failed. Don't give the attacker any more information then necessary.

&lt;?php

// WARNING MAKE SURE YOU ONLY RUN THIS AGAINST A TEST DATABASE

$bad_sql = 'id) VALUES (1); DELETE FROM tracker; INSERT INTO tracker(id';
$json = json_encode(array(array($bad_sql =&gt; '99999')));

$ch = curl_init();

curl_setopt($ch, CURLOPT_URL,            "http://yourdomain/api.php" );
curl_setopt($ch, CURLOPT_RETURNTRANSFER, 1 );
curl_setopt($ch, CURLOPT_POST,           1 );
curl_setopt($ch, CURLOPT_POSTFIELDS,     $json);
curl_setopt($ch, CURLOPT_HTTPHEADER,     array('Content-Type: application/json'));

$result=curl_exec ($ch);

var_dump($result);