move $params into parameter list on insert()

[the-liquid-metal]

in yii\db\Command::insert(), the $params = []; statement in method body seems to be useless. so it would be useful if it be placed on parameter.

Q	A
Is bugfix?	no
New feature?	yes
Breaks BC?	no

[rob006]

in yii\db\Command::insert(), the $params = []; statement in method body seems to be useless.

No, it's not. Just check QueryBuilder::insert() docs: http://www.yiiframework.com/doc-2.0/yii-db-querybuilder.html#insert()-detail

[cebe]

params are passed to QueryBuilder::insert() by reference so after the call it will not be empty anymore. Its all correct here.

[the-liquid-metal]

Please compare:
yii\db\Command::insert()
with:
yii\db\Command::update() and
yii\db\Command::delete()

In update() and delete(), the $params is present at parameter list, not the body.

As a comparison, please refer to Executing Non-SELECT Queries, at 2nd example. With that code, we can execute single query with only 1 method call.
Yii::$app->db->createCommand()->insert(...) or
Yii::$app->db->createCommand()->update(...) or
Yii::$app->db->createCommand()->delete(...)

Unfortunatly that code is for safety data. If we work with unsafety data, we have to use the last param of update() or delete(), which is $params = [].

What about insert()?
There is no $params = [] in parameter list, so we can not write single method call in order to work with unsafety data.

If insert() is revised, we will get consistent API.
Example code if we work in unsafety data, (and of course if insert() is revised):

// INSERT (table name, column values, parameters)
Yii::$app->db->createCommand()->insert('user', [
    'name' => ':name',
    'age' => ':age',
], [    // this is the part which i propose to be
    ':name' => $_POST['name'],
    ':age' => $_POST['age'],
])->execute();

// UPDATE (table name, column values, condition, parameters)
Yii::$app->db->createCommand()->update(
    'user',
    ['status' => ':status'],
    'age > 30',
    [':status' => $_POST['status']]
)->execute();

// DELETE (table name, condition, parameters)
Yii::$app->db->createCommand()->delete(
    'user',
    'status = :status'
    [':status' => $_POST['status']]
)->execute();

[cebe]

@the-liquid-metal you only need $params if you write SQL as a string, this is possible in delete() and update() because you specify a condition. On insert you only pass a PHP array, so there is no need to use param binding yourself, yii will do that internally.

[the-liquid-metal]

@cebe is it safe to write:

// INSERT (table name, column values, parameters)
Yii::$app->db->createCommand()->insert('user', [
    'name' => $_POST['name'],
    'age' => $_POST['age'],
])->execute();

even though $_POST potentially contains sql injection?

[cebe]

yes, it's mentioned in the documentation here:

yii2/framework/db/Command.php

Line 419 in 3dc8f42

* The method will properly escape the column names, and bind the values to be inserted.

I updated the guide to be more clear about this: a3501ed

[the-liquid-metal]

I think it is necessary to provide example code for update() and delete() on guide in order to use $param and handling unsafety data.

[cebe]

I think it is necessary to provide example code for update() and delete() on guide in order to use $param and handling unsafety data.

here you are: fddb34b

[the-liquid-metal]

Great! thank you.