Certainly, the current API cannot be changed without a BC break. However, an API that is not well designed should be changed to something more secure.
All inputs should be validated. Yes, that is correct. But have you guys ever forgotten to validate input values?
With the current API, developers create a vulnerability that if they forget to validate
$id even once, all records will be updated.
I can't think of a use case like this sample where you want to update all records at the same time when updating a single record.
UPDATE table and
UPDATE table WHERE id = ? are fundamentally different use cases. There is no need to provide both in the same method.
