Dangers of CSV Injection
The thing that puzzles me the most is, that people use _C_SV at all. Separation by comma, or any other member of the printable subset of ASCII in the first place. What this essentially boils down to is ambiguous in-band-signalling and a contextual grammar.ASCII had addressed the problem of separating entries ever since its creation: Separator control codes. There are:x01 SOH "Start of Heading"x02 STX "Start of Text"x03 ETX "End of Text"x04 EOT "End of Transmission"x1C FS "File Separator"x1D GS "Group Separator"x1E RS "Record Separator"x1F US "Unit Separator"You can use those just fine for exchanging data as you would using CSV, but without the ambiguities of separation characters and the need to quote strings. Heck if payload data is limited to the subset ASCII/UTF-8 without control codes you can just dump anything without the need for escaping or quoting.So my suggestion is simple. Don't use CSV or "P"SV (printable separated values). Use ASV (ASCII separated values).