Are these MySQL Abstraction Classes safe from SQL Injection?  Can they be made safe?
Active record instances are not "models". They are anti-patterns which RoR likes call that way. And what you are implementing there is an active record.

And no, those queries are not safe. They are wide open for SQL injection, because, instead of using proper SQL prepared statements, you opted for concatenation.

As for build building model, you have to understand that model is a layer. One of two in MVC. The other being - presentation layer (made of controllers, views and templates). You might read this answer, but I am no sure how much of it you will be able to assimilate. 

I think your first priority should be to read the hashphp PDO tutorial and then watching the list if lecture that you can find a the bottom of this post. And only then try another stab at the whole "mvc thing".