framework/db/QueryBuilder.php
public function update($table, $columns, $condition, &$params)
    {
        list($lines, $params) = $this->prepareUpdateSets($table, $columns, $params);
        $sql = 'UPDATE ' . $this->db->quoteTableName($table) . ' SET ' . implode(', ', $lines);
        $where = $this->buildWhere($condition, $params);
        return $where === '' ? $sql : $sql . ' ' . $where;
    }
public function update($table, $columns, $condition, &$params)
    {
        list($lines, $params) = $this->prepareUpdateSets($table, $columns, $params);
        $sql = 'UPDATE ' . $this->db->quoteTableName($table) . ' SET ' . implode(', ', $lines);
        $where = $this->buildWhere($condition, $params);
        return $where === '' ? $sql : $sql . ' ' . $where;
    }
Creates an UPDATE SQL statement.

For example,

```php
$params = [];
$sql = $queryBuilder->update('user', ['status' => 1], 'age > 30', $params);
```

The method will properly escape the table and column names.

@param string $table the table to be updated.
@param array $columns the column data (name => value) to be updated.
@param array|string $condition the condition that will be put in the WHERE part. Please
refer to [[Query::where()]] on how to specify condition.
@param array $params the binding parameters that will be modified by this method
so that they can be bound to the DB command later.
@return string the UPDATE SQL