CSV Formula Injection Scanner
Scan CSV cells for spreadsheet formula injection (=, +, -, @).
What is Formula Scan?
A security scanner for CSV exports: cells beginning with = + - @ or tab can execute as formulas when opened in a spreadsheet — a known attack vector.
How it works
Every cell's first character is checked against the dangerous prefixes; findings are listed by row/column, and optional sanitization prepends a single quote.
- Enter your input. Type or paste your input into the field above — the tool responds instantly.
- Review the result. Output updates live as you type. Everything runs entirely in your browser.
- Copy or download. Use the Copy button to grab the result, or Download to save it as a file.
Examples
Security check before importing
Scan an exported CSV for cells starting with =, +, -, or @ — the markers that can execute formulas when opened in Excel or Sheets.
Common mistakes
Only checking the first column
Injection can hide in any cell. The scanner checks every cell and reports the row and column of each hit.
Frequently asked questions
What exactly is CSV injection?
Cells beginning with formula characters are interpreted as live formulas by spreadsheet apps, which can exfiltrate data or run commands.
Can it fix the dangerous cells?
Yes — a sanitize option neutralizes them (typically by prefixing an apostrophe or space) and exports a safe copy.