How to Make a CSV Safe to Open in Excel (Cells That Start With = + - @)

To make a CSV safe to open in Excel, put a single quote in front of every cell that starts with =, +, - or @, or with a tab or a line break. The quote tells the spreadsheet the cell is text. The CSV formula injection sanitizer finds those cells, lists each one with its row and column, adds the quote and gives you the safe file, all in your browser.

This matters for any list built from web forms, scrapes or exports, because those fields hold whatever a stranger typed.

What formula injection is

A spreadsheet treats a cell that begins with an equals sign, a plus, a minus or an at sign as a formula. A CSV is plain text, so it stores those cells like any other until you open the file in Excel or Google Sheets. OWASP describes this as CSV injection: a formula can call a function, add a link or ask the program to reach another file. Its usual advice is to start the cell with a single quote.

Step 1: find the cells by hand

Open the file in a plain text editor, not in Excel, and look for cells that start with one of the trigger characters. In a text editor you can search for ,=, ,+, ,- and ,@, which find cells that follow a comma, and check the first column and header separately. A search inside Excel is too late, because the program has already read the file.

By hand, this is slow on a long list and easy to miss, especially for cells that start with a tab or a line break, which you cannot see.

Step 2: decide what to leave alone

A cell that is only a number, such as -5 or -1,250.75, is not a formula, so it does not need protecting. The tool leaves these as they are by default and you can switch that off to protect them too.

Phone numbers are the common surprise. A number written as +1 555 010 0100 begins with a plus, and a spreadsheet can read it as a formula. After the quote is added it reads as text, which is what you want for a phone number.

Step 3: use the sanitizer

1. Upload the CSV or .xlsx, or paste the cells with the header row first.
2. Choose whether plain numbers are left alone.
3. Read the list of changed cells with the row, the column and the character that started each.
4. Download the safe file.

The header row is checked too. A header that starts with a trigger character is changed like any other cell.

Step 4: open the safe copy, keep the original

Open the safe file in Excel or Sheets, and keep the untouched original for imports. Excel hides a leading single quote and shows the rest as text. A sending tool or a CRM reads the quote as part of the value, so an import from the safe copy would store '+1 555 010 0100 instead of the number.

If the file also has stray spaces or invisible characters, clean them first with how to remove spaces and hidden characters from a CSV, and see how to clean CSV columns before an import.

What this cannot do

• It does not judge whether a formula is harmful. Every cell with a trigger character is treated the same.
• A cell that starts with a space and then an equals sign is not changed, because a spreadsheet reads it as text.
• The added quote becomes part of the cell for programs that are not spreadsheets.
• Only the first sheet of a workbook is read.
• It protects the file you open. It says nothing about whether the data is true.

Check the addresses next

A safe file can still be full of dead addresses. Upload the list on the verify page: the first 100 email checks are free with a Google sign-in, no card. Each address comes back valid, risky or invalid with a reason, and nothing is sent to anyone on the list. For larger or recurring lists, see bulk email verification, list cleaning and pricing.

Make your file safe now

Upload it to the CSV formula injection sanitizer.