Guides
CSV formula injection and safer exports
CSV quoting preserves field boundaries, but does not stop spreadsheet software from interpreting a cell as a formula. Choose an export strategy for the intended app and test it there.
Which format should you choose?
Choose by the role each file plays in your workflow.
- CSV for machine processing → Preserve values and follow the recipient parser's specification
- CSV opened by people in a spreadsheet → Choose output that treats untrusted values as text and test it in the target app
- Is quoting enough? → CSV syntax handling and preventing formula execution are separate
- Which sanitization is right? → Apps differ; do not assume one universal transformation
A CSV cell may be interpreted as a formula
When CSV output contains values from a web form or database, Excel, LibreOffice Calc, or another spreadsheet app may interpret a cell beginning with characters such as `=` as a formula. If an attacker can control the input, this could expose data or cause other harm through app behavior or user actions. The impact depends on the app and its settings.
CSV quoting alone does not prevent formulas
Wrapping a field in double quotes and escaping quotes inside it is syntax handling: it keeps commas and line breaks within the intended field. Whether spreadsheet software treats that cell as a formula is a separate interpretation step. Correct CSV escaping alone is not proof that formula injection has been mitigated.
Choose text-safe output for the target app
Distinguish CSV for machine processing from files people will open in a spreadsheet. For the latter, consider a spreadsheet library or format that can explicitly store a value as text. If CSV is required, test how the target app handles values beginning with `=`, `+`, `-`, or `@`, then choose an app-specific measure. Prefixing a tab or apostrophe can affect compatibility or change the underlying value, so it is not universally safe.
Account for delimiters and cell boundaries
Commas, semicolons, quotes, and line breaks in untrusted values can create unintended cells if output is assembled incorrectly; a new cell may then begin with a formula marker. Use a standard CSV library to encode fields correctly, and handle formula interpretation separately for the target app. Do not rely on string concatenation or checking only the first input character.
Test by opening, saving, and reopening
Test representative edge cases, including leading whitespace, control characters, delimiters, and quotes, in the spreadsheet apps you support. Include a save-and-reopen cycle. OWASP warns that Microsoft Excel may remove quotes or escaping when a CSV is saved and reopened, potentially reactivating a previously neutralized value. Keep machine-readable source data separate from output transformed for spreadsheet viewing.
Formats to consider
CSV
Good for: Exchanging simple tables when the recipient treats cell contents as data
Less suitable for: Exporting untrusted values for spreadsheet use without app-specific mitigation and testing
Before you export
- CSV quoting and escaping are not a security boundary against formula execution.
- Spreadsheet apps differ in formula detection, warnings, and save-and-reopen behavior.
- Before distributing CSV with untrusted input, test it in the target app, including after reopening the saved file.