Paste a column of values and format them as an IN clause, VALUES rows or INSERT statements (runs in your browser)
This replaces the column-select trick people repeat in their editor every time they need an ad hoc query.
It is handled. Following the SQL rule, a single quote inside a value is doubled, so o'hara becomes 'o''hara'. Note that this tool is an aid for assembling SQL by hand. Queries executed from an application should use placeholders (bind variables); building SQL by concatenating strings is how SQL injection happens.
It depends on the database. Oracle Database limits an IN list written inline to 1000 expressions and raises ORA-01795 beyond that. This tool warns once you pass 1000 items. For larger sets, load the values into a temporary table and join, or split the list and combine the parts with OR.
No. The conversion happens entirely in your browser, with no network request and no storage. Even so, avoid pasting real production data into a browser on someone else machine or a shared terminal, regardless of how the tool is implemented.
In auto mode each value is checked for being a signed integer or decimal and only those are left unquoted; everything else is quoted. A code with a leading zero such as 007 is not treated as numeric, so it is quoted. If you already know the column is a string type, choosing always quote is safer than relying on detection.
Uncheck the deduplicate option, which is on by default. Duplicates in an IN clause do not change the result, but removing them keeps the statement easier to review and helps with the limit on the number of expressions.