CSV Formula Injection Scanner & Cleaner

What counts as risky. Following the OWASP guidance on CSV injection (CWE-1236), a cell is flagged when its text begins with =, +, - or @, or with a tab or carriage-return character that can hide the sign. Each flagged cell gets a level:

• High: the cell also looks like a command or DDE call (program|topic!item, cmd, powershell) or calls a function that can fetch data or run something (HYPERLINK, WEBSERVICE, IMPORTXML, IMPORTDATA, IMAGE and similar).
• Medium: any other cell that starts with =, or with +, - or @ followed by text, or with a hidden tab.
• Low: cells that start with one of those characters but look like plain numbers, phone numbers or social handles (-12.5, +8801712345678, @jane). Spreadsheets mostly read these as numbers, so they are shown but not changed by default.

The parser reads RFC 4180 CSV: quoted fields, doubled quotes, line breaks inside quotes, comma, semicolon, tab and pipe delimiters detected automatically, UTF-8 with or without a byte-order mark, UTF-16 and a Windows-1252 fallback.

The cleaner rewrites only the flagged cells. By default it puts an apostrophe in front, as OWASP recommends; you can choose a space instead, and choose which levels to change. Everything else in the file, including quoting and line endings, stays byte for byte as it was. You get a table of the first changes (before and after), the cleaned CSV, and a CSV report of every flagged cell whose own text is neutralised so the report cannot trigger a formula itself.

Know the trade-off. A leading apostrophe or space makes the cell text, not a formula, but it changes the stored value (and Excel shows the apostrophe when it opens a CSV). Do not clean cells that are meant to be real formulas.

Read more. The guide CSV injection explained covers how a cell becomes a formula and how to export safely.

Text files with delimiters: .csv, .tsv and .txt up to 40 MB; UTF-8 (with or without BOM), UTF-16 and Windows-1252. Output: the cleaned file in UTF-8 (with a BOM if the original had one or was not UTF-8) and a CSV report. Spreadsheet files (.xlsx, .xls) are not supported; export them to CSV first.

1. Drop a .csv, .tsv or .txt file onto the box. It is scanned in your browser.
2. Read the verdict and the table of flagged cells: row, column, level, the cell text and why it was flagged.
3. Choose how to protect cells (apostrophe or space) and which levels to change. The before and after table updates.
4. Download the cleaned CSV, and the report if you need to show someone what was found.

• Checking a customer or order export before opening it in Excel
• Cleaning a CSV that will be sent to colleagues or an accountant
• Testing whether your application's CSV export escapes user input
• Finding out why a spreadsheet shows #NAME? or a security prompt for a CSV
• Producing a report of risky cells for a security review

This looks only at how a spreadsheet may interpret the first character of each cell. It does not judge what a formula would do and is not an antivirus. Excel, LibreOffice and Google Sheets differ in which prefixes they treat as formulas and in what they show, and a new prefix could appear in the future. The apostrophe or space protection changes cell values; formulas you intend to keep must be left out of cleaning.

It does not remove other kinds of risky content such as very long text, links inside text cells that are not formulas, or macros in other file types. At most 50,000 flagged cells are listed and changed per file.