CSV formula injection checker
Find CSV cells with potentially executable spreadsheet prefixes. Review their locations and download a findings report.
Paste a CSV to inspect its headers and data cells. The checker flags potentially executable prefixes such as =, +, - and @, related fullwidth characters and leading control characters. The findings table shows the record number, column number, column name, original string and reason. Record 0 is the header. A flagged string is not proof that a spreadsheet will execute it. Legitimate negative numbers can be flagged. Conversely, this check cannot guarantee that a file is safe in every spreadsheet or import workflow. Quoting CSV cells alone does not neutralize formulas, and spreadsheet applications can interpret or alter escaping differently. The default main CSV prefixes detected strings with an apostrophe. This is a mitigation, not a universal spreadsheet safety guarantee, and it changes the affected cell strings. Preserve original cells is available for trusted machine processing. The separate findings CSV always prefixes potentially executable values; the JSON report records the choice and counts. Include a header row. Quote cells that contain commas or new lines. Results update as you type. Up to 1,000,000 characters.
Your result
How to use CSV formula injection checker
- Paste CSV with unique headers and choose its separator.
- Inspect every flagged location and decide whether the string is expected.
- Choose formula handling and download the main CSV, findings CSV and report.
Useful next steps
What to expect
Find CSV cells with potentially executable spreadsheet prefixes. Review their locations and download a findings report. Paste a CSV to inspect its headers and data cells. The checker flags potentially executable prefixes such as =, +, - and @, related fullwidth characters and leading control characters. The findings table shows the record number, column number, column name, original string and reason. Record 0 is the header. A flagged string is not proof that a spreadsheet will execute it. Legitimate negative numbers can be flagged. Conversely, this check cannot guarantee that a file is safe in every spreadsheet or import workflow. Quoting CSV cells alone does not neutralize formulas, and spreadsheet applications can interpret or alter escaping differently. The default main CSV prefixes detected strings with an apostrophe. This is a mitigation, not a universal spreadsheet safety guarantee, and it changes the affected cell strings. Preserve original cells is available for trusted machine processing. The separate findings CSV always prefixes potentially executable values; the JSON report records the choice and counts.
Try a small example
value,note =2+2,formula -42,may be a legitimate number safe,plain text