Support formula injection escaping

Created on 11 April 2025, 14 days ago

Problem/Motivation

See https://csv.thephpleague.com/9.0/interoperability/escape-formula-injection/ for documentation of this feature.

Would it be possible for an option to be available whereby the formula injection formatted could be added to the export pipeline please?

Once this is available in this module I'd like to provide support for it in the Views Data Export module too.

Proposed resolution

Add support for adding this formatter as per the docs:


use League\Csv\EscapeFormula;
use League\Csv\Writer;

$formatter = new EscapeFormula();
$writer = Writer::createFromPath('php://temp', 'r+');
$writer->addFormatter($formatter->escapeRecord(...));
$writer->insertOne(['2', '2017-07-25', 'Important Client', '=2+5', 240, null]);
$writer->toString();
//outputting a CSV Document with all CSV Formula Injection escaped
//"2,2017-07-25,\"Important Client\",\"\t=2+5\",240,\n"

Remaining tasks

Write the additional code that'll allow adding this as an option.

User interface changes

None.

API changes

Provide a way for consuming modules to add this filter.

Data model changes

None.

Feature request
Status

Active

Version

4.0

Component

Code

Created by

🇬🇧United Kingdom steven jones

Live updates comments and jobs are added and updated live.
Sign in to follow issues

Comments & Activities

Production build 0.71.5 2024