I have a form that takes user input and records them in a table. My form sanitizes user input by deleting certain characters (mentioned below). I can export a CSV of the table, which outputs the cells as it is.
The correct way to prevent a CSV injection is to prefix a single quote to the start of a cell that looks like a formula, i.e. those starting with
However, if the input instead escapes characters like
| by deleting them before it gets recorded in the table for CSV export, will that be sufficient by itself?
So far, the only 'injection' I have managed to do is '=SUM(1+1)', due to it being impossible to use popular payloads like
@SUM(1+1)*cmd|' /C calc'!A0 or
DDE ("cmd";"/C calc";"!A0")A0, as the key characters get deleted.