CSV escape and unescape

How CSV escape works: one rule and a pair of quotes

CSV has exactly one escape sequence. A double quote inside a field is written as two double quotes, and the whole field is then wrapped in a pair of them. A product name such as 27" monitor, black is stored as "27"" monitor, black". Every spreadsheet and every serious CSV library reads that back as the original eighteen characters. Nothing else gets a special spelling: a backslash, an apostrophe or an emoji goes into the file exactly as it is.

The harder question is when a field needs the quotes at all. Wrapping is required when the field contains the delimiter, a double quote, a line feed or a carriage return. Without it, the comma would split one value into two columns and the line break would start a new record halfway through. Plain words, numbers and spaces are fine unquoted, which is why exports usually quote only some cells and why this tool does the same unless you ask for every field.

The delimiter decides what counts as special

A file saved by Excel in Germany, Sweden or France often uses a semicolon, because the comma is the decimal separator there. In a semicolon-separated file, 3,5 kg is an ordinary value and needs no quotes, while red;blue does. Tab-separated exports and pipe-delimited data dumps follow the same logic with their own character. Choose the delimiter the receiving file really uses; the result above changes the moment you switch, and the tool mentions it when your text contains one of the other common delimiters.

Spaces, byte order marks and backslashes

Leading and trailing spaces belong to the field under RFC 4180, and Python’s csv module keeps them. Some importers trim unquoted values anyway; with Python’s skipinitialspace option we saw a leading space vanish from an unquoted field and survive in a quoted one. If your destination trims, choose every field quoted. A byte order mark at the very start of a file is removed by readers that decode UTF-8 with a signature, so a first field that genuinely begins with U+FEFF is quoted automatically. A backslash has no meaning in CSV: \" is not an escaped quote. Python’s strict reader rejects "a\"b" outright, and its lenient mode returns the scrambled a\b".

CSV injection is a separate problem

A cell that begins with =, +, - or @ can be run as a formula when the file is opened in Excel, Google Sheets or LibreOffice. OWASP lists this as CSV injection, and quoting does nothing against it, since the spreadsheet strips the quotes before it evaluates the cell. The common defense is to put an apostrophe in front of such a value. That is available here as an option and is switched off by default, because the apostrophe is real data: a database import, a script or Unescape on this page all hand it back. A plain negative number such as -5 is left alone, since a spreadsheet evaluates it to itself.

Reading a field back

Unescape takes a single field as it appears in a file. When it starts with a quote, the text up to the closing quote becomes the value, and each doubled quote turns back into one. Problems that a strict reader rejects are listed with their position instead of silently repaired: a quote that is never closed, characters after the closing quote, or a quote, delimiter or line break inside an unquoted field. Lenient readers glue such text together, and the value you get here matches what they produce, so you can see both the damage and the result.

Line breaks inside a field need a file

Browsers convert every CR LF typed or pasted into a text box to a lone LF before any script can see it. For a multi-line address or note that came from Windows, that silently changes the field. Open the text as a file and its bytes are kept, and a quoted field carries the carriage return unchanged. The same trap exists on the reading side: Python only keeps it when the file is opened with newline="".

How the results were checked

Every rule on this page was measured against Python’s csv module, a reader we did not write: hundreds of generated fields full of quotes, delimiters, NUL, CR LF, byte order marks and emoji, in comma, semicolon, tab and pipe files, all came back identical. Python 3.9 and 3.10 refuse any row containing a NUL character, while 3.12 to 3.14 read it. Excel and Google Sheets could not be run here, so what the page says about them comes from their documentation and OWASP.

Related tools

To inspect a whole file rather than one field, open it in the CSV viewer, whose export quotes cells with the same function as this page, as JSON to CSV does. A whole workbook is quicker through Excel to CSV, and CSV to JSON goes the other way. When the value is headed for a JSON string or an HTML page instead, use the JSON escaper or HTML escaping.

Private by design

This page has no server behind it. The quoting and unquoting happen in your browser tab, the address bar never carries what you enter, and nothing is logged, so customer exports and other private rows are fine to work with.