Quoted CSV and formula-like text: check the XLSX handoff

01Quotation marks delimit fields; they do not declare cell types

RFC4180’s CSV format description explains quoted fields containing commas, quotes or line breaks, and doubling a quote within a quoted field. These are record-parsing rules. CSV has no cell-type field equivalent to the typed cells in an XLSX workbook.

OWASP’s CSV injection guidance explains that spreadsheets can interpret certain leading characters as formulas, and that some escapes may lose their intended effect when opened, saved or reimported. Quoting alone is not a universal sanitization strategy. We use only the harmless=2+2 to inspect whether formula-like content remains literal text.

If the file first has delimiter, encoding or date-parsing problems, use the CSV import and column-type guide. Correct structure and correct cell types are separate checks.

02Four records distinguish four different requirements

This original teaching input has a header followed by four data records. The final note contains a line break, so physical text lines outnumber data records. IDs001–004 identify records; they are not quantities to calculate.

The first note starts with an equals sign to check literal text. The second contains a comma, the third a double quote and the fourth a line break. These test both typing and CSV syntax. Successfully opening a file does not verify all four.

record_id,note
001,"=2+2"
002,"Lunch, paid"
003,"He said ""ready"""
004,"Line one
Line two"

03Choose Text before conversion, then inspect the result

The current preview defaults to text columns, but confirm each column before handing off a result. Choosing Number and then expecting leading zeros to survive is inconsistent. Do not convert a note into a formula merely because it resembles one. Our actual run used the current default text types and did not execute the workbook in desktop Excel.

1. 1
   Open CSV to Excel, upload the sample and confirm UTF-8, comma separation and a header in the first row.
2. 2
   Confirm Text for both columns. Count four data records rather than treating the quoted line break as another record.
3. 3
   Convert and download XLSX. Check counts, values and IDs. A technical review can inspect cell types and formula nodes in the OpenXML of a file copy.

04What this particular test establishes

On October 27,2026, we uploaded the source CSV through the live entry and downloaded the workbook. Inspection found one sheet, five rows including the header and two columns. All ten cells were strings, and sheet1.xml contained no formula nodes. The literal=2+2 was not written as a formula, and comma, quote and line-break values matched individually.

The evidence covers this input, the current converter and the downloaded file structure. A recipient exporting CSV again, changing types or pasting into another application may trigger fresh inference. This is not evidence that arbitrary hostile content is neutralized in every consumer. Describe the handoff as preserving a text note column rather than carrying a universal safety guarantee.

05When CSV is mandatory, deliver an import agreement too

If the recipient accepts XLSX, explicit text cells are easier to verify than an untyped CSV alone. If CSV is mandatory, retain the original master and arrange a controlled text-import process with the recipient, specifying column types. Do not assume double-clicking will interpret values as intended.

Adding an apostrophe or tab changes the underlying data, and applications differ in their handling of these characters. Do not silently alter interface IDs or notes to improve one preview. For the broader numerical-versus-text decision, see the long-ID text-column handoff example.