I just assumed that as the function is working with $postdata rather than $_POST, that any validation had been done prior to the information being passed into the function. Of course, it’s equally possible that the $_POST array is passed in without any checking.
And I agree the query looks malformed, but we don’t know what ->insert() does with it. And we still don’t know what the problem is.