I don't think this change api - however maybe I'm missing something?

The only change is that instead of directly putting value into sql statement it uses param binding (but only for arrays and integers). This is bug in `addJoinMultiple()` that it adds values directly to statement instead of binding them. The result set will be the same. I've added second assertion to prove that this doesn't change sql.

You may also ask why it doesn't bind values for strings and why I didn't fix that - well, this is probably one of the reason why this method i @deprecated. There is no way with this method to ensure that value provided as string is value which should be bind or if it is table name. So you shouldn't put values directly from user input to this method if they are strings as it is prone to sql injection.