SQL Formatter

What the SQL formatter changes

The formatter starts major clauses such as SELECT, FROM, WHERE, joins, grouping, ordering, limits, inserts, updates, and returning clauses on stable lines. Top-level comma-separated items receive their own indented lines, and top-level AND, OR, and ON conditions are separated for scanning. Operators receive consistent surrounding spaces.

Recognized keywords can be converted to uppercase while table names, column names, function names, numbers, operators, and quoted text retain their original spelling. Running the formatter twice produces the same result, which keeps code review diffs predictable. Semicolons separate statements, so a pasted migration or query batch remains readable without inventing a new statement boundary.

Strings, identifiers, and comments

Whitespace replacement is unsafe when it is applied with broad regular expressions: a keyword or comment marker can occur inside data. Cryonel tokenizes single-quoted strings, double-quoted identifiers, MySQL backtick identifiers, SQL Server bracket identifiers, PostgreSQL dollar-quoted bodies, line comments, and block comments before laying out clauses. Those protected tokens are emitted without rewriting their contents.

The lexer understands doubled quote characters and ordinary backslash escapes well enough for formatting, but database modes can change escape rules. A vendor-specific literal, procedural block, JSON operator, or extension may have syntax outside this focused tokenizer. Compare the output before committing a production migration, especially when the statement contains generated code or a database-specific language.

Formatting is not SQL validation

A readable query can still reference a missing table, use the wrong parameter type, return too many rows, or contain a syntax error. This tool does not build an abstract syntax tree, connect to a schema, plan the query, or execute it. It cannot detect ambiguous columns, unsafe casts, missing indexes, transaction mistakes, privilege problems, or dialect incompatibilities.

Use the target database’s parser and EXPLAIN facilities for validation and performance analysis. Run data-changing statements inside a controlled transaction or disposable environment first. Formatting should make review easier; it should never replace parameter binding, least-privilege credentials, backups, migration checks, or an execution plan.

Keep SQL safe at application boundaries

Formatting does not protect against SQL injection. Values from users, URLs, JSON, environment variables, and webhook payloads must be passed through the database driver’s parameter interface rather than concatenated into a formatted string. Dynamic identifiers need an explicit allowlist because placeholders generally represent values, not table or column names.

Queries can contain customer data, credentials, private schema names, and internal comments. Cryonel keeps the input in the current browser tab, but you should still redact sensitive data before sharing a copied result. If the query begins as JSON, use JSON to SQL to generate a reviewable PostgreSQL starting point and format the result here.