Skip to content
TextArray1.41.0
100% local

CSV injection sanitizer

Neutralize CSV cells that a spreadsheet would run as a formula when the file is opened.

Input
Output
Related tools
CSV column validatorDeveloper tools
Change CSV delimiterDeveloper tools
CSV ⇄ JSON converterDeveloper tools
Voice transcript cleanerText cleaning
Remove lines starting with a numberText cleaning
TTS sanitizerText cleaning
CSV injection sanitizer
Paste CSV data and this tool finds every cell that starts with =, +, - or @ — the characters Excel, Google Sheets and other spreadsheet applications interpret as a formula when opened — and neutralizes them before you export. This is the standard mitigation for CSV injection: cells like =HYPERLINK("http://evil.example","click") can run code or leak data on the opening machine, and are a routine way for user-submitted CSV exports to smuggle in malicious payload.
Choose your defusing method. "Prepend apostrophe" adds a leading ' — the classic Excel-safe prefix, invisible once opened, that forces the value as text. "Prepend space" adds a space instead, for tools that mishandle apostrophes. "Wrap in quotes" surrounds the value with quote characters so the formula text becomes visibly quoted. Turn on "Also sanitize leading tab and line-break characters" to extend protection to cells starting with tabs or line breaks — additional leading characters some spreadsheet and DDE parsers treat as significant, per OWASP CSV injection guidance.
Set the field delimiter to match your file — comma, semicolon, tab, pipe or a custom character — so cells parse correctly, including quoted values containing the delimiter, embedded quotes or line breaks. Turn on "List sanitized cells with coordinates" for a report of which cells changed, by row and column, appended after the cleaned CSV — useful for auditing before import.
Everything runs locally in your browser. Rows you paste can contain customer data, ticket contents or anything else private, and none leaves your device — parsing and sanitizing happen entirely client-side. Copy the result, download it as .txt, or send it straight into another tool.
FAQ
What is CSV injection?
It is a technique where a cell value starting with =, +, - or @ is interpreted as a formula by a spreadsheet application when the CSV is opened, letting an attacker run commands or leak data from the machine that opens the file. It is a common risk in CSV exports built from user-submitted data.
Why prepend an apostrophe instead of just removing the character?
Removing the leading character would change the data. A leading apostrophe is a standard spreadsheet convention that forces a cell to be read as plain text without altering the visible value once opened.
Does "Wrap in quotes" fully protect against formula execution?
It makes the formula-like text visible as quoted data rather than hidden, but some spreadsheet applications still evaluate formulas inside quoted CSV fields. Prepending an apostrophe or a space is the more reliable neutralization for most tools.
Why sanitize leading tab and line-break characters too?
Some spreadsheet and legacy DDE parsers treat a cell that begins with a tab or a line break as significant in ways similar to a formula prefix. Turning the option on extends the same defusing to those cells; it is off by default in strict RFC 4180 workflows where that risk does not apply.
Is my CSV data uploaded anywhere?
No. Parsing and sanitizing both run entirely in your browser — the rows you paste never leave your device.