PostgreSQL: Permission to execute function (that inserts into a table) but no permission to insert directly
You have to have another role, that has privileges to write directly to tables. Then you create the function using this another role, and add to function definition "SECURITY DEFINER" clause. And then you grant execute on this function to your web role.
You can read more about it in documentation.
You might also want to check blog post that I once wrote about securing database.