formula-injection

Zero-dependency PHP Excel import/export for real .xlsx files. No Composer or PhpSpreadsheet. Includes preview-based bulk import, row validation, transaction safety, Excel formula injection protection, XXE and Zip Slip defenses, PDO/MySQL and DataTables.

A zero-config, language-agnostic gate that statically flags CSV/formula injection - code writing user-controlled data to CSV/spreadsheet output without neutralizing the formula-trigger characters (= + - @ tab CR) that let a cell execute in Excel/Sheets. Single Go binary. Grounded in OWASP CSV Injection / CWE-1236.

Privacy-first GitHub Action for auditing CSV formula-injection risk

Privacy-first browser CSV cleaner with destination-aware formula-prefix handling.

Local-first CSV/TSV inspection and safe sanitization before sharing or import.

Secure output sanitization and input inspection for JSON/JSONL, CSV, and TSV — guards against formula injection, bidi-override, control-character, and encoding attacks.