Well, yes, there are safe ways of doing this, but I think the problem is you're looking for an off-the-shelf solution, and I'm not sure there is such a beast. Everyone's data and schema are going to be different so there really isn't a universal way of doing this, you generally need to roll your own. You might be able to use a pipelining tool like Pentaho to pull it off, but I'm not sure that is any easier than learning how to do a basic PHP or HTML/Python/Perl page that can parse a standardized file.

From a security standpoint, what you are really after is space between mysql and the user. As long as you are running only your vetted SQL statements, and sanitizing the user's input to prevent sql injection attacks, you're about as safe as you can be in this situation.

Yes, ultimately, it ends up being something in between, like a php app, etc. I wanted to ask in the forums in case there might be some things I was not aware of.

Not really looking for an off-the-shelf, I know those things don't exist but often there are tools which are the basis of a solution, where you customize it for your needs.

In the end, there don't seem to be any tricks of the trade that I am unaware of so it will end up being exactly what you are saying.

Thanks to everyone for their help.