Just implemented a CSV importer/exporter for a big release and this document came in super helpful.
Are there any CSV exploits that can't be solved by just prefixing fields that start with "=", "+", "-", and "@" with an apostrophe?
Are there any CSV exploits that can't be solved by just prefixing fields that start with "=", "+", "-", and "@" with an apostrophe?
Unfortunately, even if you put an apostrophe on everything, problems remain:
- the apostrophes are non-standard and assure all other CSV-handling tools get the wrong, apostrophe-prefixed values
- Excel itself doesn't escape fields on output, so if someone loads your exported file into Excel, saves it and reloads it, the exploits come back
Excel is a quite frighteningly terrible tool for handling CSV.