有人可以帮我理解为什么这段代码真的有用吗？

Question

I've been following the Laracasts "PHP Practitioner" series to help me get a basic understanding of PHP and at this point, my code works fine and doesn't return any errors, but I can't quite grasp how it actually works.

If you've watched the series, in Episode 20, in our QueryBuilder.php file, we create an insert method with 2 parameters "$table" and "$parameters". I get why "$table" works as we assign it to the 'users' table in the add-name.php file, but how does the text in the form get submitted to the database via the $parameters param? I'm not exactly following the logic so well and I just want to fully understand what's happening here.

For those of you who haven't watched the series and have no idea what I'm talking about, we basically make a simple form with an input and a submit button and at this point, we are sending the info from the form into a DB. Here's the snippet from the QueryBuilder.php file:

public function insert($table, $parameters)
    {
        $sql = sprintf(
         'INSERT INTO %s(%s) values (%s)', 
         $table, 
         implode(', ', array_keys($parameters)),
         ':' .implode(', :', array_keys($parameters))
        );

        try{
        $statement = $this->pdo->prepare($sql);
        $statement->execute($parameters);

    } catch (Exception $e){
            die($e->getMessage());
        }
    }

and here's the add-name.php file:

<?php

$app['database']->insert('users', [
    'name' => $_POST['name']
]);

header('Location: /laracasts/PHP');

Answer 1

Please take a look at this https://www.php.net/manual/en/book.pdo.php

PDO works in a way that allows you to define the query structure and then add your values to it. This is made in order to deny SQL injection.

$statement = $this->pdo->prepare($sql);
$statement->execute($parameters);

In the first line you are preparing the query you defined, you tell PDO which kind of query you want to run. In the second line you actually run it, binding your parameters to the query.