CSV to SQL Insert Generator

Escaping is the part that bites

A single apostrophe in a value, in a name like O'Brien, terminates the string literal and breaks the statement. In SQL the fix is doubling it, not backslash-escaping, which differs from most programming languages and is the mistake people make first. Backslashes, and in MySQL specifically, need handling too. A generator that concatenates values without escaping produces statements that fail on the first Irish surname and, worse, would be an injection vector if the same code ran against untrusted input.

Parameterised statements are safer

Generated INSERT statements are convenient for a one-off import and are string concatenation by nature. For anything repeated or driven by data you do not control, use parameterised queries or your database's bulk loader instead. Treat generated SQL as a migration artefact you inspect before running, not as a pattern to build into an application.

Types must be decided, not guessed

CSV carries no types. Numbers must not be quoted or the database will either reject them or silently coerce. Strings must be quoted. Dates need the target's expected format, which differs between MySQL, PostgreSQL and SQL Server. Empty cells are the subtle one: an empty string and NULL are different values, and quoting an empty cell as an empty string when NULL was intended produces data that looks fine and behaves wrongly in every query using IS NULL.

Batch, do not send one statement per row

A multi-row INSERT with many value tuples is dramatically faster than the same rows as individual statements, often by an order of magnitude, because each statement otherwise carries its own parsing and transaction overhead. Batches of 500 to 1000 rows are a reasonable default; very large single statements can exceed the server's maximum packet size.

Column order and headers

Always name the columns explicitly in the INSERT rather than relying on table order. A column added to the table later silently shifts positional inserts, and the failure is data landing in the wrong fields rather than an error.

Generated locally

Parsing and generation happen in your browser. Spreadsheets destined for a database routinely contain customer records, so the file never leaving your machine matters.