Security
CSV Injection Sanitizer
Puts an apostrophe in front of cells that a spreadsheet would run as a formula — anything starting with =, +, -, @, a tab or a carriage return.
When to use it
Use it as the last step before writing a CSV or Excel file that people will open, whenever the data came from users or other systems (CSV / formula injection).
In a pipeline
File InputCSV Injection SanitizerExport CSV
Settings
| Setting | Type | Required | Default or hint |
|---|---|---|---|
| Columns | select | — | None picked: every column |
| Also prefix plain numbers like -12.5 | checkbox | — | false |
Example
Neutralise a formula in a comment
| Name | Comment | Change |
|---|---|---|
| Ann | =HYPERLINK("http://x") | -12.5 |
| Bob | Great! | +3 |
| Name | Comment | Change |
|---|---|---|
| Ann | '=HYPERLINK("http://x") | -12.5 |
| Bob | Great! | +3 |
-12.5 and +3 are plain numbers, so they are left alone unless you tick the option to prefix those too.
Worth knowing
- This is the OWASP recommendation for CSV injection: the ' makes Excel and Sheets show the text instead of running it.
- With no columns picked, every column is checked. The note says how many cells were neutralised.
- Number cells (not text) are never touched.