Skip to content
Randozi
All wheelsTools

CSV Formula Injection Guard

A spreadsheet can run a cell that starts with = + - or @ as a formula. Paste your CSV, see exactly which cells are affected, and get a version where they are turned into plain text. It all happens in your browser.

Cells neutralized

3

Checked 15 cells in 5 rows (comma-separated). 3 cells starting with =, +, -, @, a tab or a carriage return were neutralized with a leading apostrophe. 1 number-like cell starting with + or - was left as is.

Safe CSV

name,email,note
Ann,ann@example.com,'=1+1
Bob,bob@example.com,-5
Cy,cy@example.com,'+33 6 12 34 56
Dee,dee@example.com,'@SUM(A1:A2)
RowColumnBeforeAfter
23=1+1'=1+1
43+33 6 12 34 56'+33 6 12 34 56
53@SUM(A1:A2)'@SUM(A1:A2)

A cell that starts with = + - @, a tab or a carriage return can be run as a formula by a spreadsheet. The apostrophe makes Excel, Google Sheets and LibreOffice show the cell as text; other programs may display the apostrophe. This reduces the risk, it is not a guarantee: only open files you trust, with formulas and links disabled when you can. The output keeps the separator of the input, uses one line break per row, and drops empty lines.

How it works

  1. Paste your CSV or TSV. The separator is detected, or choose it.
  2. Choose how to neutralize: a leading apostrophe or a leading space. Keep “plain numbers” ticked so -5 stays as it is.
  3. Check the count and the before and after table of the changed cells.
  4. Copy or download the safe CSV.

What people use it for

  • Exporting user data

    Clean a list of names, comments or form answers before you hand it to someone who will open it in Excel.

  • Importing from a form

    Check what visitors typed into a contact form before the file goes to your team.

  • Reviewing a CSV you received

    See which cells start with a formula character before you open the file in a spreadsheet.

Questions

What is CSV formula injection?
When a cell starts with = + - or @ (or a tab or a carriage return), many spreadsheet programs treat it as a formula, not as text. If an attacker put such a value in a field that you later export, opening the file could run a function, show a link or ask to run a program. This page finds those cells and puts a character in front so the program reads them as text.
What does the apostrophe do, and is it a full protection?
Excel, Google Sheets and LibreOffice read a cell that begins with an apostrophe as text and hide the apostrophe. Some other programs show it. It lowers the risk but is not a guarantee: only open files you trust, and disable automatic formulas, links and external content when you can.
What happens to numbers like -5 or +1.5?
With “Keep plain numbers” on, a cell made only of a sign and digits (-5, +1.5, -1,234.56, 1e3) is left alone, because no formula can hide in it. Anything else that starts with + or - is neutralized, including a phone number written “+33 6 12 34 56”. Turn the option off to prefix every cell that starts with a sign.
How is the CSV read and written?
Quotes follow RFC 4180: a cell may be quoted, a doubled quote is one quote, and a cell can contain the separator or a line break. The file is rewritten with the same separator and one line break per row, a cell is quoted only when needed, and empty lines are dropped. The file is limited to 500,000 characters and the list of changes shows the first 50.