When the regex engine replaces the first ",," with ",NULL,", it does not continue matching inside of the replacement string, so the only thing left for it to match and replace is the last two ",,". One solution is zero-width Lookaround Assertions:

my $sql = ",,,,";
print "<$sql>\n";               # <,,,,>
$sql =~ s/(?<=,)(?=,)/NULL/g;
print "<$sql>\n";               # <,NULL,NULL,NULL,>
[download]

However, editing SQL like this seems like it might not be the best approach. If you're using DBI you should use placeholders, and if you're generating SQL, I recommend you look into modules that do that, like SQL::Abstract (example).

(Update: AnomalousMonk, hippo, and choroba were a little faster :-) )