3 ms·
Just implemented a CSV importer/exporter for a big release and this document came in super helpful. Are there any CSV exploits that can't be solved by just pre
by claudiulodro 9y ago
Just implemented a CSV importer/exporter for a big release and this document came in super helpful.
Are there any CSV exploits that can't be solved by just prefixing fields that start with "=", "+", "-", and "@" with an apostrophe?
- bobince 9y agoYou might consider prefixing other fields with an apostrophe to avoid them being misinterpreted as numbers or dates. Unfortunately, even if you put an apostrophe on everything, problems remain: - the apostrophes are non-standard and assure all other CSV-handling tools get the wrong, apostrophe-prefixed values - Excel itself doesn't escape fields on output, so if someone loads your exported file into Excel, saves it and reloads it, the exploits come back Excel is a quite frighteningly terrible tool for handling CSV.