Database method to query
That query method (and the db class) has a lot of responsibilities:


Do the PDO stuff, connection handling
Be a query builder
be a query executor
Handle the params and possibly execute the same statement with different params (it would to that too)
Do all the error checking
maybe more i don't see


Usually that functionality is handled in 2 to 3 classes, sometimes even more and not in one single function.

And you are doing some very creepy magic to achieve all the work

foreach ($vals as $v) { if (empty($$v)) { $$v = ''; } }


and all that so you can write 

array("select " =&gt; "something" , ...


instead of 

"select something" ...


Also you are using mysql_real_escape_string so it seems you don't want to use the pdo escaping (not binding parameters) so why try to use PDO if you limit yourself to mysql anyways ? 

So far everything i spotted thinking about it for 5 minutes. Will improve upon feedback / direction from you if it helped at all :)