WC_CSV_Exporter::escape_data( string $data )
Escape a string to be used in a CSV context
Contents
Description Description
Malicious input can inject formulas into CSV files, opening up the possibility for phishing attacks and disclosure of sensitive information.
Additionally, Excel exposes the ability to launch arbitrary commands through the DDE protocol.
See also See also
Parameters Parameters
- $data
-
(Required) CSV field to escape.
Return Return
(string)
Source Source
File: includes/export/abstract-wc-csv-exporter.php
public function escape_data( $data ) {
$active_content_triggers = array( '=', '+', '-', '@' );
if ( in_array( mb_substr( $data, 0, 1 ), $active_content_triggers, true ) ) {
$data = "'" . $data;
}
return $data;
}
Changelog Changelog
| Version | Description |
|---|---|
| 3.1.0 | Introduced. |