Always fun to learn and create! Just a quick note:

(fitting something malicious inside a varchar100 would be a real feat, ngl)

Fitting something malicious into 100 characters is not a feat, it's trivial - especially with your custom query builder function, for example if I enter the following into the name field:

"name'); DELETE FROM users; --"

I could delete the whole table; same scenario if I created an API call to the endpoint that resolves to your selectColumns func, if I submit $orderby with a similar SQL statement I could run any arbitrary command I wanted.

This technique is called 'SQL injection' and is a very common attack vector, please google it and check your code!