$form->labelEx($userModel, 'password2',array('id'=>'xxx'))形式设置id，多个form同理。

yii\db\Command.php里面在createCommand的时候，会默认用bindValue对参数进行处理，所以你可以放心的用上述写法而不用担心注入问题。

    /**
     * Binds pending parameters that were registered via [[bindValue()]] and [[bindValues()]].
     * Note that this method requires an active [[pdoStatement]].
     */
    protected function bindPendingParams()
    {
        foreach ($this->_pendingParams as $name => $value) {
            $this->pdoStatement->bindValue($name, $value[0], $value[1]);
        }
        $this->_pendingParams = [];
    }