Reviewed 2026-08-28
Prevent Spreadsheet Formula Injection
Detect formula prefixes before a CSV is opened in spreadsheet software.
Example input
name,note
Ada,=HYPERLINK("https://example.test")Expected output
name,note
Ada,'=HYPERLINK("https://example.test")Reproducible method
- Preserve the original and create the smallest representative sample.
- Run a strict parse or validation before transformation.
- Record options, compare counts and structure, then test in the receiving system.
Common error
A harmless-looking cell can execute as a formula after export.
Reduce a failure while retaining the problematic structure; this separates malformed input from unsupported behavior.
Technical limitation
Escaping rules vary by spreadsheet product and import workflow.
A successful preview does not remove format ambiguity or downstream requirements.
Security and privacy
Treat exported CSV as active content and verify with the target product.
Local processing reduces transfer risk but cannot protect a compromised browser, unsafe extensions, clipboard history, or later misuse.
Verification checklist
- Check field, record, page, or byte counts.
- Review edge cases and error output.
- Retain the original until acceptance.
- Document assumptions for automation.