Having special characters is a good idea but having a comma just to break a CSV is dumb. This would only happen if the hacker used a bad exporter or created their own (very poorly).
Edge cases get hard when dealing with nested commas, and there's no standard escape sequence.
Probably matters less with a two column arrangement, but things get really hairy really fast when you start adding types or BLOBs in the CSV.
>but things get really hairy really fast when you start adding types or BLOBs in the CSV.
AFAIK BLOBs are hex encoded, which make them a non issue.
If blobs got consistently hex encoded, that would also be nice. Base64 is common, and there are multiple types of base64 encoding people use too.
Personally, I tend to think of CSV imports as something you can expect to have a ‘yield’ - and it’s never 100%.