I don't believe I can prepare the statement in prepare because I need to know at least how many columns there. Unless you have any ideas for a workaround?

Good call on the ` character. DBAL implements a quoteIdentifier method but it would complicate things considerably to emulate it. The method includes this comment: 

    NOTE: Just because you CAN use quoted identifiers does not mean
    you SHOULD use them. In general, they end up causing way more
    problems than they solve.

maybe we just get rid of the table name quoting. If the user knows they're using a reserved word they can manually quote it.