SPARKPOND / GUIDE
CSV Formula Injection: Risks and Safe Exports
A spreadsheet may interpret cells beginning with =, +, -, @, tab or carriage return as formulas when a CSV opens.
Problem symptoms
- A cell runs a function when opened.
- Phone numbers beginning with + are interpreted unexpectedly.
Why it happens
- CSV has no type metadata.
- Spreadsheet software auto-interprets cell text.
Example before and after
Before
name,note Ada,"=HYPERLINK(...)"
After
name,note Ada,"'=HYPERLINK(...)"
Procedure
- Scan first characters after whitespace.
- Review every flagged cell.
- Choose a destination-safe text prefix.
- Validate the serialized export before download.
Common mistakes
- Executing the file to see whether it is safe.
- Removing every leading plus sign without review.
Other possible solutions
- Import the column explicitly as text in the destination spreadsheet.
Important limitations
- Spreadsheet behavior varies; no CSV can control every consumer.