    public static function addParam($param, $value, $post_id) {
        $sql = array(
                'table' => 'posts_param',
                'key' => array(
                        'post_id' => $post_id,
                        'param' => $param,
                        'value' => $value
                    )
            );
        $q = Db::insert($sql);
        if ($q) {
            return true;
        }else{
            return false;
        }
    }

The software constructs all or part of an SQL command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended SQL command when it is sent to a downstream component.