Skip to content

SQLPatch β€” IDs/List to SQL Generator

Turn a list of IDs or a spreadsheet column into a ready-to-run SQL IN clause, bulk UPDATE, or DELETE statement β€” free, with real injection-safe escaping.

Runs entirely in your browser β€” your files are never uploaded to a server.

This tool processes your file entirely in your browser. Nothing is uploaded to our servers.

How It Works

1. Choose Your File

Drag & drop or select the file you want to work with.

2. Processed in Your Browser

Everything happens locally on your device β€” your file is never uploaded anywhere.

3. Download Your Result

Get your finished file instantly, ready to save or share.

About SQLPatch β€” IDs/List to SQL Generator

Turning a spreadsheet column of IDs into a properly formatted SQL IN clause, or a two-column list of IDs and new values into a bulk update, is exactly the kind of task that’s simple in principle but genuinely tedious and error-prone to do by hand once the list runs past a handful of rows.

A worked example: pasting the three lines 1,Alice, 2,Bob, 3,Carol in Bulk UPDATE mode generates a complete, ready-to-run statement:

UPDATE users
SET name = CASE id
    WHEN 1 THEN 'Alice'
    WHEN 2 THEN 'Bob'
    WHEN 3 THEN 'Carol'
END
WHERE id IN (1, 2, 3);

Every value is properly escaped before being inserted β€” a name like O'Brien becomes 'O''Brien' in the output, the standard SQL convention for a literal quote inside a string, identical across MySQL, PostgreSQL, and SQL Server. This was verified specifically against real injection patterns before shipping, not just normal input β€” a value like Robert'; DROP TABLE users; -- gets fully neutralized into an inert string rather than becoming executable SQL, confirmed by simulating exactly how a real SQL parser reads the escaped output back.

Numbers and text are told apart automatically by default β€” a column of plain digits generates unquoted numeric values, while anything else is quoted and escaped as text. This can be overridden to always treat values as text, useful for something like a ZIP code with a leading zero that would otherwise be misread as a number.

Frequently Asked Questions

Is the generated SQL safe from injection?

Yes β€” every value is escaped using the standard SQL convention before insertion, verified against real injection patterns, not just normal input.

Does this work for MySQL, PostgreSQL, and SQL Server?

The value-escaping convention used here is identical across all three, so the generated statements work correctly regardless of which one you're using.

Why does the tool refuse to generate a statement sometimes?

If no valid values are found, no SQL is generated rather than producing broken output β€” an empty IN () clause, for example, is invalid in most SQL dialects, so the tool won't create one.

Can a value contain a comma, like "Smith, Jr."?

Yes, for Bulk UPDATE only the first comma on each line separates the ID from the value β€” everything after it is treated as the full value, commas included.