How to stop a CSV file from running formulas when you open it

Last updated October 28, 2026

A CSV file is plain text, but spreadsheet programs will treat a cell as a formula if it starts with certain characters. When you copy product titles, buyer notes or supplier data into a file that others will open, that can cause bad results at best and security problems at worst. The issue is known as CSV injection or formula injection. This guide explains what to check and how to reduce the risk.

What the risk is

OWASP's page on CSV injection says that when a spreadsheet program such as Excel or LibreOffice Calc opens a CSV, any cell starting with = is interpreted as a formula, and that crafted formulas can be used to exploit software flaws, trick users into ignoring warnings, or exfiltrate data. It lists the characters to watch: =, +, -, @, tab, carriage return and line feed, and also full-width versions of some of them in some locales.

Steps you can take

  1. Know where the text came from. Titles you typed yourself are low risk. Text from customers, suppliers or scraped pages is not.
  2. Scan the first character of every text cell. In a spreadsheet, add a helper column: =OR(LEFT(A2,1)="=",LEFT(A2,1)="+",LEFT(A2,1)="-",LEFT(A2,1)="@") and filter for TRUE.
  3. Fix the cells. Where the text is legitimate (a title like “-5 degree sleeping bag”), the common fix is to put a single quote in front of the value so the program reads it as text. Real numbers such as -5 should stay numbers.
  4. Know the limits. OWASP notes that the quote-prefix technique is not reliable in Microsoft Excel after the file is saved and reopened, because Excel may remove the quote. For Excel, OWASP's suggested stronger mitigation is to prefix any cell starting with =, +, - or @ with a tab character inside the quoted field. Read the OWASP page for the details and the tradeoffs.
  5. Keep Protected View on and do not enable macros or external links in a file you did not create.
  6. Check marketplace rules. A marketplace upload may treat a leading quote or tab as part of your text. Test with a few rows first and look at the result on the marketplace.

When not to alter the data

If a value really must start with one of these characters, for example a negative number or a phone number with a plus sign, treat it as a number or as text in the destination column and verify the upload, rather than blindly adding characters.

Listloom has a “Protect against spreadsheet formulas” option, on by default. When you export, it puts a leading apostrophe in front of any data cell starting with those characters (except plain numbers such as -5), and says so in the export message. As OWASP notes, that technique has limits in Excel, so you can switch it off if your destination needs the raw text, and you should look at your file before you upload it.

Sources

  1. OWASP Foundation, "CSV Injection": https://owasp.org/www-community/attacks/CSV_Injection (read 2026-10-28)

Related tool: Listloom. Estimates and guidance only; check the source documents before relying on a figure.

More Listloom guides

All guides