CSV reference
CSV format reference for reliable imports and exports
Understand records, fields, delimiters, quoting, embedded line breaks, headers, encoding, line endings, and spreadsheet safety.
Document summary
A practical CSV reference for creating files that parse consistently across spreadsheets, databases, scripts, and import systems.
Key takeaways
- CSV has common conventions but many real files use different delimiters and encodings.
- Quote fields that contain delimiters, quotation marks, or line breaks.
- Treat spreadsheet formula-like values as a security and data-integrity concern.
CSV represents rows and fields
Each record is written as a row, and fields are separated by a delimiter. Comma is common, but semicolon, tab, and pipe-delimited files are also widely encountered.
A parser should use the selected or detected delimiter consistently for the whole file.
Quote fields when content conflicts with structure
A field containing the delimiter, a quotation mark, or a line break should be enclosed in double quotes. A quotation mark inside a quoted field is represented by two quotation marks.
name,note
Ava,Uses commas, sometimesname,note
Ava,"Uses commas, sometimes"
Noah,"He said ""Hello"""Headers and data types are conventions
CSV itself does not define a schema or data types. A header row is common but not guaranteed. Every field is text until the receiving application interprets it.
Document column names, null rules, date formats, decimal separators, and identifiers outside the file or in an agreed import specification.
| Value | Possible interpretation | Risk |
|---|---|---|
| 00123 | Text identifier or number | Leading zeros can disappear |
| 03/04/2026 | Date | Day and month order is ambiguous |
| 1,25 | Decimal in some locales | Comma may also be the delimiter |
| TRUE | Boolean or text | Receiving system conventions differ |
Encoding and line endings affect portability
UTF-8 is a practical default when all systems support it. Some spreadsheet software uses or expects a byte order mark, while other workflows treat it as part of the first header.
Files may use LF or CRLF line endings. A robust parser should handle both, including line breaks inside properly quoted fields.
Review spreadsheet formula injection
When a CSV is opened in spreadsheet software, cells beginning with characters such as =, +, -, or @ may be interpreted as formulas. Untrusted content can become executable spreadsheet expressions.
Escape, prefix, or otherwise neutralize formula-like values according to the destination and security policy. Do not assume quoting alone prevents evaluation.
Use an interoperability checklist
- 1
Confirm delimiter and quote rules.
- 2
Confirm whether a header row exists.
- 3
Use a known encoding.
- 4
Define date, decimal, null, and identifier handling.
- 5
Validate equal row widths.
- 6
Test embedded delimiters, quotes, and line breaks.
- 7
Open the export in the actual destination application.
