Build a MySQL upsert query to insert/update multiple records in Python
Should I be quoting or escaping some strings/fields?


Yes, you should definitely escape table and field names. Currently this is trivial to exploit. It should not be possible to produce invalid SQL with any input parameters. If you get to that point there might not be any exploits left.


  The existing solutions for upsert and batch-insert seem more generalized, and therefore slower, than implementing a MySQL-specific solution.


Which options are these? And have you tested them? I would be very surprised if there are no options available which would save you much more time overall than rolling your own.


  Also, I'm clearly in love with str.format()—is this the best way of handling string composition?


str.format() is very nice for relatively simple format strings, but in this code it's hard to see what the actual result will be for some given input. I would pull out variables for the various .join()ed strings, but even then it's a big string to compose.

Some general things:


Use more descriptive variable names. database = MySQLdb.connect(… and cursor = database.cursor() are much more descriptive.
Use transactions by initialising your cursors using with database.cursor() as cursor:
You'll want to run your code through pep8 to improve readability.