JSON to CSV Converter & Table Exporter
Convert JSON arrays into RFC 4180 compliant CSV spreadsheets with custom delimiters, UTF-8 BOM encoding for Excel, and instant download.
⚠️ 5 Fatal Traps in CSV Exports & Spreadsheet Data Integrity
💥 1. CSV Formula Injection / DDE Remote Code Execution
Spreadsheet processors (Excel, LibreOffice, Google Sheets) execute any cell beginning with =, +, -, or @ as a live mathematical formula or Dynamic Data Exchange (DDE) command. Malicious inputs like =CMD|' /C powershell ...'!A1 trigger arbitrary command execution when opened. Always prefix formula-leading characters with an apostrophe (').
⚖️ 2. The Missing UTF-8 BOM Mojibake Corruption
Excel on Windows defaults to the system ANSI code page (Windows-1252) when opening CSV files without a leading Byte Order Mark (BOM). Without a UTF-8 BOM (), all accented characters (é, ü), Cyrillic, Asian glyphs, and currency symbols (€, £) turn into unreadable garbled mojibake (e.g. é).
🛡️ 3. Unescaped Multiline & Delimiter RFC 4180 Violations
RFC 4180 dictates that any cell value containing the delimiter (comma), line breaks (
), or double quotes must be wrapped in enclosing double quotes, with internal quotes escaped by doubling (""). Failing to strictly quote multiline user text breaks row alignment and crashes downstream automated ETL pipelines.
🔍 4. Scientific Notation Truncation on Large Identifiers
Spreadsheet engines automatically coerce long numeric strings (16-digit credit card numbers, order IDs, or tracking codes e.g. 1234567890123456) into scientific notation (1.23457E+15). Excel permanently rounds the last digits to zero, irreversibly corrupting business transaction logs upon saving. Format large numeric IDs with explicit tab or text wrappers.
🚀 5. Heterogeneous JSON Key Skew in NoSQL Datasets
In document databases (MongoDB, DynamoDB), JSON records are schema-less. Naively inspecting only the first object (Object.keys(data[0])) discards columns that appear exclusively in later records or shifts cell data into incorrect columns. A robust converter must scan all objects to compile an exhaustive master header set.