diff --git a/library/think/db/Builder.php b/library/think/db/Builder.php
index 5665a939..ecec0b0e 100644
--- a/library/think/db/Builder.php
+++ b/library/think/db/Builder.php
@@ -27,7 +27,7 @@ abstract class Builder
     // SQL表达式
     protected $selectSql    = 'SELECT%DISTINCT% %FIELD% FROM %TABLE%%FORCE%%JOIN%%WHERE%%GROUP%%HAVING%%ORDER%%LIMIT% %UNION%%LOCK%%COMMENT%';
     protected $insertSql    = '%INSERT% INTO %TABLE% (%FIELD%) VALUES (%DATA%) %COMMENT%';
-    protected $insertAllSql = 'INSERT INTO %TABLE% (%FIELD%) %DATA% %COMMENT%';
+    protected $insertAllSql = '%INSERT% INTO %TABLE% (%FIELD%) %DATA% %COMMENT%';
     protected $updateSql    = 'UPDATE %TABLE% SET %SET% %JOIN% %WHERE% %ORDER%%LIMIT% %LOCK%%COMMENT%';
     protected $deleteSql    = 'DELETE FROM %TABLE% %USING% %JOIN% %WHERE% %ORDER%%LIMIT% %LOCK%%COMMENT%';
 
@@ -719,9 +719,10 @@ abstract class Builder
      * @access public
      * @param array     $dataSet 数据集
      * @param array     $options 表达式
+     * @param bool      $replace 是否replace
      * @return string
      */
-    public function insertAll($dataSet, $options)
+    public function insertAll($dataSet, $options, $replace = false)
     {
         // 获取合法的字段
         if ('*' == $options['field']) {
@@ -754,8 +755,9 @@ abstract class Builder
         }
         $fields = array_map([$this, 'parseKey'], array_keys(reset($dataSet)));
         $sql    = str_replace(
-            ['%TABLE%', '%FIELD%', '%DATA%', '%COMMENT%'],
+            ['%INSERT%', '%TABLE%', '%FIELD%', '%DATA%', '%COMMENT%'],
             [
+                $replace ? 'REPLACE' : 'INSERT',
                 $this->parseTable($options['table'], $options),
                 implode(' , ', $fields),
                 implode(' UNION ALL ', $values),
diff --git a/library/think/db/Query.php b/library/think/db/Query.php
index 8140a229..b08436cd 100644
--- a/library/think/db/Query.php
+++ b/library/think/db/Query.php
@@ -2117,9 +2117,10 @@ class Query
      * 批量插入记录
      * @access public
      * @param mixed $dataSet 数据集
+     * @param boolean $replace  是否replace
      * @return integer|string
      */
-    public function insertAll(array $dataSet)
+    public function insertAll(array $dataSet, $replace = false)
     {
         // 分析查询表达式
         $options = $this->parseExpress();
@@ -2127,7 +2128,7 @@ class Query
             return false;
         }
         // 生成SQL语句
-        $sql = $this->builder->insertAll($dataSet, $options);
+        $sql = $this->builder->insertAll($dataSet, $options, $replace);
         // 获取参数绑定
         $bind = $this->getBind();
         if ($options['fetch_sql']) {
diff --git a/library/think/model/relation/HasManyThrough.php b/library/think/model/relation/HasManyThrough.php
index 7d0d5124..1573fc65 100644
--- a/library/think/model/relation/HasManyThrough.php
+++ b/library/think/model/relation/HasManyThrough.php
@@ -130,10 +130,9 @@ class HasManyThrough extends Relation
     {
         if (empty($this->baseQuery) && $this->parent->getData()) {
             $through      = $this->through;
-            $model        = $this->model;
-            $alias        = Loader::parseName(basename(str_replace('\\', '/', $model)));
+            $alias        = Loader::parseName(basename(str_replace('\\', '/', $this->model)));
             $throughTable = $through::getTable();
-            $pk           = (new $this->model)->getPk();
+            $pk           = (new $through)->getPk();
             $throughKey   = $this->throughKey;
             $modelTable   = $this->parent->getTable();
             $this->query->field($alias . '.*')->alias($alias)