noatmark

CSV security

CSV injection sanitizer

Paste CSV data and escape every cell that starts with = + - @ or a tab — so opening it in Excel, WPS, or Google Sheets can't silently run hidden formulas.

🔒 100% private — in-browser 🛡️ OWASP — formula injection defense ✅ free — no sign-up
🛡️
Ready to sanitize Paste CSV on the left, then hit Sanitize. Cells starting with = + - @ get a leading quote so Excel treats them as text.

What is CSV formula injection?

When a CSV cell starts with =, +, -, @, a tab, or a carriage return, spreadsheet apps (Excel, WPS, LibreOffice) may treat it as a formula and execute it. An attacker can export data like =HYPERLINK("http://evil.com","click me") or +cmd|'/C calc' and, if your app naively serves that CSV, a victim's spreadsheet runs it on open. It's a real injection class, listed by OWASP.

How we fix it

  1. Parse. We split your CSV into cells, respecting quoted fields and escaped quotes.
  2. Escape. Any cell leading with a dangerous character is prefixed with a single quote ' — the spreadsheet then treats it as plain text, not a formula.
  3. Export. Copy or download the sanitized CSV, safe to open and share.

What gets escaped

  • Cells starting with = (formulas, =cmd, =HYPERLINK)
  • Cells starting with + or - (numeric formula prefixes)
  • Cells starting with @ (Lotus formula / command prefix)
  • Cells starting with a tab or carriage return

Everything runs locally in your browser — your CSV never leaves your device.