CSV to SQL INSERT

Turns a CSV with a header row into INSERT statements: column names from the header, values quoted where they need it, apostrophes escaped, and empty fields written as NULL.

The escaping is the whole job. SQL escapes an apostrophe by doubling it, so `O'Brien` has to become `'O''Brien'` — and getting that wrong is not a formatting bug, it is the exact mechanism of SQL injection. Every value here goes through that escape, and numeric-looking values are left unquoted so a column typed as an integer accepts them. Batched or not is a real choice. One statement per row is easy to read and easy to re-run after a failure; a single statement with many value tuples is dramatically faster, because the round trip and the parse happen once rather than a thousand times. For an import of any size, batch it — but keep the batches to a few thousand rows, since most servers have a limit on statement size. Worth saying plainly: statements built by string concatenation are for a one-off import you run by hand. An application should use parameters, which move the escaping into the driver where it cannot be forgotten.