Fixes #3752: `QueryBuilder::batchInsert()` does not typecast input values

framework/CHANGELOG.md

@@ -40,6 +40,7 @@ Yii Framework 2 Change Log
 - Bug #3601: Fixed the bug that the refresh URL was not generated correctly by `Captcha` (qiangxue, klevron)
 - Bug #3715: Fixed the bug that using a custom pager/sorter with `GridView` may generate two different pagers/sorters if the layout configures two pagers/sorters (qiangxue)
 - Bug #3716: `DynamicModel::validateData()` does not call `validate()` if the `$rules` parameter is empty (qiangxue)
+- Bug #3752: `QueryBuilder::batchInsert()` does not typecast input values (qiangxue)
 - Bug: Fixed inconsistent return of `\yii\console\Application::runAction()` (samdark)
 - Bug: URL encoding for the route parameter added to `\yii\web\UrlManager` (klimov-paul)
 - Bug: Fixed the bug that requesting protected or private action methods would cause 500 error instead of 404 (qiangxue)

framework/db/QueryBuilder.php

@@ -183,10 +183,6 @@ class QueryBuilder extends \yii\base\Object
             $columnSchemas = [];
         }
 
-        foreach ($columns as $i => $name) {
-            $columns[$i] = $this->db->quoteColumnName($name);
-        }
-
         $values = [];
         foreach ($rows as $row) {
             $vs = [];
@@ -206,6 +202,10 @@ class QueryBuilder extends \yii\base\Object
             $values[] = '(' . implode(', ', $vs) . ')';
         }
 
+        foreach ($columns as $i => $name) {
+            $columns[$i] = $this->db->quoteColumnName($name);
+        }
+
         return 'INSERT INTO ' . $this->db->quoteTableName($table)
         . ' (' . implode(', ', $columns) . ') VALUES ' . implode(', ', $values);
     }

framework/db/sqlite/QueryBuilder.php

@@ -68,10 +68,6 @@ class QueryBuilder extends \yii\db\QueryBuilder
             $columnSchemas = [];
         }
 
-        foreach ($columns as $i => $name) {
-            $columns[$i] = $this->db->quoteColumnName($name);
-        }
-
         $values = [];
         foreach ($rows as $row) {
             $vs = [];
@@ -91,6 +87,10 @@ class QueryBuilder extends \yii\db\QueryBuilder
             $values[] = implode(', ', $vs);
         }
 
+        foreach ($columns as $i => $name) {
+            $columns[$i] = $this->db->quoteColumnName($name);
+        }
+
         return 'INSERT INTO ' . $this->db->quoteTableName($table)
         . ' (' . implode(', ', $columns) . ') SELECT ' . implode(' UNION SELECT ', $values);
     }