Can a customer name or order note contain a formula that runs when I open the CSV in Excel?

How a formula ends up in your file

Your store saves whatever the customer types. If someone enters a name starting with an equals sign, the store does not object, because to it that is just text. But when you export the orders, convert them to CSV and open the file in Excel, the spreadsheet sees a cell beginning with = and evaluates it. This is known as CSV formula injection, and the danger is that it fires at the moment of opening, unnoticed.

The simplest case is a disguised link: a cell that reads 'click' but opens a strange site if a staff member reviewing orders clicks it. Formulas can be more elaborate than that, so the rule is that text from an outside source should never open as a formula at all.

What the tool did with test data

We tried three orders: a name starting with a HYPERLINK formula and a total of -50 as a number, a name starting with @ and a total of '-50' stored as text, and a note starting with a dash and a total of 20. With default protection the file came out as:

name,total "'=HYPERLINK(""http://x.example"",""click"")",-50 "'@SUM(A1)","'-50" "'-refund",20

Three things to notice in that result:

• All three names gained a leading ', so Excel shows them as text rather than formulas.
• The -50 stored as a number in the JSON is untouched, because real numbers are left alone.
• The same amount stored as the text '-50' did gain the mark, because the tool cannot know that text is meant as a number. If your amounts are strings in the JSON, make them numbers at the source where you can.

A safe way to export customer data

1. Open the CSV and JSON converter and choose 'JSON to CSV'.
2. Paste the order data, and look it over first in the JSON formatter and validator if it is long.
3. Make sure 'Protect against Excel formulas' is ticked; it is by default.
4. Download the file and open it in Excel for review.

When switching protection off is acceptable

If every value came from you, such as a product list you prepared yourself, and the file is headed for an import system rather than a spreadsheet, you may need the text exactly as written with no extra mark. Then switch the option off. For any file with a field typed by an outside party, keep it on even when the data looks harmless.

Remember that the protection only concerns the output file. It does not clean the data in your store or flag suspicious entries; it makes sure they open as text. If you spot a ' in front of a name in Excel, that tells you the text began with a character worth a second look.