framework/db/QueryBuilder.php
public function insert($table, $columns, &$params)
    {
        list($names, $placeholders, $values, $params) = $this->prepareInsertValues($table, $columns, $params);
        return 'INSERT INTO ' . $this->db->quoteTableName($table)
            . (!empty($names) ? ' (' . implode(', ', $names) . ')' : '')
            . (!empty($placeholders) ? ' VALUES (' . implode(', ', $placeholders) . ')' : $values);
    }
public function insert($table, $columns, &$params)
    {
        list($names, $placeholders, $values, $params) = $this->prepareInsertValues($table, $columns, $params);
        return 'INSERT INTO ' . $this->db->quoteTableName($table)
            . (!empty($names) ? ' (' . implode(', ', $names) . ')' : '')
            . (!empty($placeholders) ? ' VALUES (' . implode(', ', $placeholders) . ')' : $values);
    }
Creates an INSERT SQL statement.
For example,
```php
$sql = $queryBuilder->insert('user', [
'name' => 'Sam',
'age' => 30,
], $params);
```
The method will properly escape the table and column names.

@param string $table the table that new rows will be inserted into.
@param array|Query $columns the column data (name => value) to be inserted into the table or instance
of [[yii\db\Query|Query]] to perform INSERT INTO ... SELECT SQL statement.
Passing of [[yii\db\Query|Query]] is available since version 2.0.11.
@param array $params the binding parameters that will be generated by this method.
They should be bound to the DB command later.
@return string the INSERT SQL