php - updates secure from sql injections in yii -

could please tell if these 2 fragments of code secure in yii. fragent 1:

 $numberofrows = $this->updateall(array('full_path' => $target, 'title' => $name,                'machine_name' => $name), 'full_path = :path', array(':path' => $path)); 

should escape $target , $name in query?

fragment 2:

$sql = "update folders"; $sql .= " set full_path = concat('" . $target . "',substr(full_path, " . (strlen($path)  + 1) . ", length(full_path)-1))"; $sql .= " full_path '" . $path . "%'"; $command = $this->dbconnection->createcommand($sql); $command->execute(); 

should escape $target , full_path here using cdbconnection::quotevalue() or in these 2 fragments? 1 how escape path in fragment 2 avoid issues special symbols used (%, _).

i made changes fragment 2 using binds , escaping %_:

$sql = "update folders"; $sql .= " set full_path = concat(:target, substr(full_path, " . (strlen($path) + 1) . ", length(full_path)-1))"; $sql .= " full_path  :pathfilter"; $command = $this->dbconnection->createcommand($sql);  //escape %_ can used in sql expression $pathfilter = addcslashes($path, '%_') . '%';  $command->bindparam(":pathfilter", $pathfilter, pdo::param_str); $command->bindparam(":target", $target, pdo::param_str);  $command->execute(); 

is correct? there more elegent way it?

speaking of more elegant ways, can avoid named parameters, dramatically shorten code:

$sql  = "update folders set"; $sql .= " full_path = concat(?, substr(full_path, ?, length(full_path)-1))"; $sql .= " full_path ?";  //escape %,_ , \ can used in sql expression $pathfilter = addcslashes($path, '\%_') . '%'; // i've added slash here  $command = $this->dbconnection->createcommand($sql); $command->execute([$target, strlen($path) + 1, $pathfilter]);