Convert Excel to SQL

What it generates

The result is a text file you can paste into your SQL client and run as is. It contains, in this order:

1. A CREATE TABLE with one column per title in the first row and a type inferred from the data, if you leave that option enabled.
2. One or more INSERT INTO ... VALUES statements with every row, grouped into batches.

The first row of the file is always used as column names: it is required, because a table cannot be created without them.

Quotes, apostrophes and SQL injection

Values are written as literals inside the script, not as parameters, because the file has to be runnable on its own. That makes escaping the most delicate part of the conversion:

• Strings are wrapped in single quotes and every single quote inside the text is doubled. A surname like O'Brien is emitted as 'O''Brien', which is the standard form and the only one that stops the text escaping the literal.
• Numbers are unquoted, with a dot decimal separator and no thousands separators.
• Booleans are emitted as 1 and 0.
• Dates are quoted in 'YYYY-MM-DD' form.
• Empty cells are emitted as NULL, unquoted — not as an empty string.

That doubling is exactly what prevents a cell containing something malicious, along the lines of '); DROP TABLE ..., from turning into instructions when the script runs: inside the literal it stops being code and becomes text.

Table and column names are sanitised separately: only letters, digits and underscores survive, and any other character becomes _. A name starting with a digit gets a c prefix, because no engine accepts identifiers that begin with a number.

Dialect and inferred types

The dialect changes how identifiers are delimited:

• Standard: undelimited.
• MySQL: backticks, `sales`.
• SQL Server: square brackets, [sales], and NVARCHAR for text.
• PostgreSQL: double quotes, lowercased, "sales".

Each column's type is inferred by looking at the whole column, not the first row. If every value is a whole number the type is BIGINT; with decimals, DECIMAL(18,6); if everything is a date, DATE; otherwise a VARCHAR/NVARCHAR sized to the next multiple of 50 above the longest string, with a floor of 50 and a ceiling of 4000. Entirely empty columns come out as VARCHAR(255).

Rounding up is deliberate: sizing to the exact character count would break the import as soon as a slightly longer value arrives.

Batch size

The INSERTs are grouped into multi-value statements. With the default of 100, each INSERT INTO carries up to 100 parenthesised rows; you can lower it to 1 — one statement per row, useful when your importer processes them individually — or raise it to 1000, which cuts the number of statements and speeds up loading.

If your engine has a statement-size or parameter limit, lower the batch before running.