SQL Formatter
Lay out a SQL statement readably, and flag the SELECT *, the missing WHERE and the concatenated value.
About this tool
Reformats a SQL statement onto readable lines with each clause indented, and reports what the layout makes visible.
Formatting is the easy half. The half worth having is what becomes obvious once the query is laid out:
**`SELECT *`** in a query that displays four columns — every extra column is read from disk, sent over the network and discarded, and adding a column to the table silently makes the query heavier.
**`DELETE` or `UPDATE` with no `WHERE`** — which affects every row in the table. Occasionally intended, and this is a statement worth being certain about before running.
**A value concatenated into the string** — a quoted literal sitting where a parameter should be. That is either something somebody typed or the shape of an injection, and the two are indistinguishable here, so the tool says what it sees rather than which one it is.
The formatter does not parse SQL fully. It will not reformat a deeply nested statement perfectly, and it never changes what the query does.
Common questions
What is wrong with SELECT *?
Every column is read, transferred and then discarded if unused, and the query silently gets heavier whenever somebody adds a column to the table. Naming the columns also makes the query self-documenting.
Why flag a quoted value in the query?
Because a literal sitting where a parameter belongs is what a concatenated query looks like. It may be perfectly deliberate. It may also be the exact shape of an injection, and the two are identical from here.
Does formatting change what the query does?
No. Only whitespace and keyword casing change. Strings and comments are protected before anything is touched, so a value containing the word SELECT is left alone.
Will it format any dialect?
It handles the common clauses across MySQL, PostgreSQL, SQLite and SQL Server. A dialect-specific construct is left on its own line rather than reformatted, which keeps it correct if untidy.