CSV formula injection sanitizer: make a list safe to open in Excel or Sheets
In short: Upload a list and see every cell that a spreadsheet would run as a formula. Each one gets a quote in front, and you download the safe file. Limit: It protects the file you open in a spreadsheet; it does not make the data itself trustworthy.
Upload a CSV or .xlsx file, or paste it with a header row. The tool lists every cell that starts with =, +, - or @, or with a tab or line break, because a spreadsheet can run those as formulas. It puts a single quote in front of each one so the cell reads as text, and you download the safe file.
Price: this tool is free. Checking a whole email list is from $9/mo, and the first 100 checks are free with Google, no card. Check your list free nowSee pricing
Sample result
Four example rows have 3 cells made safe: a =HYPERLINK note, a +1 phone number and a name starting with @ each get a quote; the -5 stays.
- Cells made safe
- 3
- Rows read
- 4
- Numbers left alone
- 1
What this means for you
A safe file can still hold dead mailboxes; a check shows which addresses exist.
- Finds = + - @ tab and line break
- Plain numbers optional
- Each change listed
- Header checked too
- Excel
- CSV
- Safe
By SimpleVerifier Team · Last updated · Runs in your browser; nothing you paste is sent to us
Made the file safe? Check the addresses before the send.
- Download the safe file, or use the check button under the result, which carries its addresses across.
- Upload or paste it at /verify. Every address gets a live mailbox check, and the first 100 email checks are free with a Google sign-in, no card.
How do I stop a CSV from running formulas when it is opened in Excel?
- Upload the file as a CSV or .xlsx, or paste the cells with the header row first.
- Decide whether plain numbers such as -5 should be left alone. They are by default.
- Read the list of cells that were changed, with the row, the column and the character that started them.
- Download the safe file and open it in your spreadsheet program.
Example
- You enter
- Four rows where one note starts with =HYPERLINK, one phone starts with +1, one note is -5 and one name starts with @, plain numbers left alone.
- You get
- 4 rows read, 3 cells made safe in 3 rows: the =HYPERLINK note, the +1 phone number and @Dev Rao each get a quote in front. The -5 is a plain number and stays as it is.
- Limits
- Runs in your browser; nothing is uploaded. It treats every cell that starts with a trigger character the same and does not judge what the formula would do.
What is CSV formula injection?
A spreadsheet reads a cell that starts with an equals sign, a plus, a minus or an at sign as a formula. If a list built from a web form, a scrape or a lead export holds such a cell, opening the file can run it. The text may call a function, add a link, or ask the program to reach out to another file.
The usual protection is to start the cell with a single quote, which tells the spreadsheet the cell is text. This tool adds that quote to every cell that begins with one of those characters, and shows you what it changed.
Which cells does it change?
Any cell whose first character is =, +, -, @, a tab or a carriage return, in the header as well as the rows. With the default setting a cell that is only a number, such as -5, +3.2 or -1,250.75, is left as it is, because it is not a formula. Switch that off to protect those too.
Phone numbers written with a plus sign, such as +1 555 010 0100, are changed, since a spreadsheet can read them as a formula. After the change they read as text, which is usually what you want for a phone number.
What does it not do?
It does not judge whether a formula is harmful; every cell with a trigger character is treated the same. The quote becomes part of the cell if the file is later read by a program that is not a spreadsheet, so use the safe file for opening in Excel or Sheets, and keep the original for imports. To fix broken rows or stray spaces first, see clean CSV columns before an import.
Who uses this tool, and for what?
- Marketers
- Open a form-signup export in Excel without a hostile cell running.
- Cold emailers
- Check a scraped lead list before it goes to a teammate or a client.
- Developers
- Make a user-data export safe before it is sent to someone who will open it in a spreadsheet.
What can’t this tool tell you?
- It protects the file you open in a spreadsheet; it does not make the data itself trustworthy.
- A cell that starts with a space and then an equals sign is not changed, because a spreadsheet reads it as text.
- The added quote is part of the cell for programs that are not spreadsheets.
- Only the first sheet of a workbook is read.
Common questions
- Why would a lead list contain a formula?
- Names, notes and company fields often come from forms and scrapes where anyone can type anything. A cell that starts with an equals sign is stored like any other text until a spreadsheet opens it.
- What does the quote look like in Excel?
- Excel hides a leading single quote and shows the rest of the cell as text. Some other programs show the quote as part of the value.
- Are negative numbers changed?
- Not by default. A cell that is just a number, such as -5, is left alone. Untick the option to change those too.
- Is the header row checked?
- Yes. A header that starts with one of the trigger characters is changed as well.
- Does it need an email column?
- No. Any CSV works. If the list has a column of addresses, the check button under the result carries them across.
- Is my file uploaded?
- No. The file is read in your browser and goes nowhere.
A tidy list can still be full of dead addresses.
Extracting, deduplicating and syntax checks all work on the text of an address. None of them can tell whether the mailbox exists. Only the server that hosts it can answer that, through an SMTP check, and that is what the paid product does.
- Upload the cleaned file as it is: CSVs up to 100,000 rows
- A real SMTP mailbox check on every row, with catch-all detection
- Small list? Starter at $9/mo covers 2,500 emails a month, cancel anytime
Plans from $9 a month, cancel anytime, no contract. Sign in with Google and your first 100 email checks are free, no card. The free tools stay free either way.