So... about those unittests huh

This is not really secure after i think about it

Sorry, no. I'm going to veto this.
Functions are just too difficult to escape properly. It's impossible to know whether the arguments are column names, strings, tables, or something else entirely, and the logic would need to differ for every function.
If you need functions in the select statement, use the normal query builder (not the simple one), and do the escaping yourself.