Dynamic insert function for PDO (for any case) I created a dynamic insert function for PDO.

It does work, but I want to be sure that it is secure and well coded.

function insertNewRows($pdo, $table, $fields, $placeholders, $values=''){

    if($values){
        $result = $pdo-&gt;prepare("INSERT INTO $table ($fields) VALUES ($placeholders)");
        $result-&gt;execute($values);
    }else{
        $result = $pdo-&gt;query("INSERT INTO $table ($fields) VALUES ($placeholders)");
    }

}


Using positional placeholders:

$session_id = '1000000001';
$createdBy  = 12;

$fields = "session_id, username, createdBy";
$placeholders = "?, 'boss 21', ?";

$values = array($session_id,  $createdBy);

insertNewRows($pdo, 'web_statistics', $fields, $placeholders, $values);


Not using positional placeholders:

$fields = "session_id, username, createdBy";
$placeholders = "'abc', 'boss 25', 3";

insertNewRows($pdo, 'web_statistics', $fields, $placeholders);


I want to use the same tactic for UPDATE and SELECT functions, so am I good to do so with the code I have written?
I don't see any point in this function in its present form.
Given you've got a general purpose query function,
function pdo($pdo, $sql, $args = NULL)
{
    $stmt = $pdo-&gt;prepare($sql);
    $stmt-&gt;execute($args);
    return $stmt;
}

it will be cleaner, easier to use and more readable to have a conventional SQL than such random rags of a code:
$session_id = '1000000001';
$createdBy  = 12;

$sql = &quot;INSERT INTO web_statistics (session_id, username, createdBy) VALUES (?,?,?)&quot;;
pdo($pdo, $sql, [$session_id,  'boss 21', $createdBy]);

The same goes for SELECT and UPDATE. You can find a complete set of examples by the link above.
Update.
Looks like this question got some traction, due to some mysterious ways of Stack overflow. It means it will attract people other than the OP, who may have the same question but have different code, or just curious about Dynamic insert function for PDO in general. Well then, I must admit that the answer is rather a trick and too localized, being focused on the actual code in the OP. For the present code, where different query parts are still hardcoded in the different function parameters, it is indeed makes a lot more sense to have them hardcoded in the form of a conventional SQL query instead.
But of course the common idea of a dynamic insert function for PDO is different. it's rather a function that is called like this:
prepared_insert($pdo, $table_name, $data);

where $data is an associative array like this
$data = [
    'name' =&gt; $name, 
    'password' =&gt; $hashed_password,
];

Well then for this case I've got a simple INSERT helper function for PDO Mysql
function prepared_insert($pdo, $table, $data) {
    $keys = array_keys($data);
    $keys = array_map('escape_mysql_identifier', $keys);
    $fields = implode(&quot;,&quot;, $keys);
    $table = escape_mysql_identifier($table);
    $placeholders = str_repeat('?,', count($keys) - 1) . '?';
    $sql = &quot;INSERT INTO $table ($fields) VALUES ($placeholders)&quot;;
    $pdo-&gt;prepare($sql)-&gt;execute(array_values($data));
}

Note that his function will need a helper function of its own,
function escape_mysql_identifier($field){
    return &quot;`&quot;.str_replace(&quot;`&quot;, &quot;``&quot;, $field).&quot;`&quot;;
}

to protect identifiers added to the query.