
Formula Injection in Excel Exports and How to Stop It
Stop formula injection in xlsx exports: write user text as strings with openpyxl or XlsxWriter, neutralize leading =, +, - and @ characters, and test it.
Tag
590 posts

Stop formula injection in xlsx exports: write user text as strings with openpyxl or XlsxWriter, neutralize leading =, +, - and @ characters, and test it.

Attributes suit short identifying values, elements suit everything with structure or long text. A test of the whitespace and ordering rules shows why.

Read CSV in PHP 8.5 with fgetcsv and SplFileObject: the $escape deprecation, a backslash that swallows the file, str_getcsv traps and the BOM.

Use FLATTEN in Snowflake to turn VARIANT arrays and objects into rows, chain it for nested levels, keep empty parents with OUTER, and read its output columns.

Read CSV in C# with CsvHelper 33: case-sensitive headers, typed ZIP codes, silent ragged rows, and a de-DE culture that made a total 91 times too big.

Export every sheet of an Excel workbook to its own CSV with pandas, openpyxl or LibreOffice, with safe file names, UTF-8, ISO dates and a manifest.

Parse CSV in Rust with the csv crate: StringRecord, ByteRecord and serde, UnequalLengths errors, typed ZIP codes and an unclosed quote it accepts.

Read JSON stored in a Snowflake VARIANT column with colon and bracket paths, cast the results, and handle JSON null, missing keys and case sensitivity.

Compare read_csv, fread and base read.csv on the same files: type guessing and ZIP codes, ragged rows, bad quotes, the BOM, and speed on 2,000,000 rows.

Convert Excel workbooks to CSV, JSON, XML and YAML without losing data: choose a format, read types, dates and headers, then verify with counts and schemas.

Read CSV in Java with OpenCSV and Commons CSV: a backslash escape that breaks paths, ints that turn blanks into 0, and a writer that quotes everything.

A tested guide to comparing XML, from canonical form and keyed record diffs to Git diffs, merges, feed shape checks and schema compatibility.