+
Writing
+
Injection Warning
+
When opening a CSV in an external program, a formula in a field could be ran that contains a vulnerability.
+Read more here: CSV Injection.
+Due to this issue, there is a setting InjectionOptions that can be configured.
+
The list of injection characters to detect are configurable in CsvConfiguration.InjectionCharacters
+and default to =, @, +, -, \t, \r. An injection character can be the first character of a field
+or quoted field. i.e. =foo or "=foo"
+
The InjectionOptions values are None (default), Escape, Strip, and Exception.
+
None
+
No injection protection is taken.
+
Exception
+
If an injection character is detected, a CsvWriterException is thrown.
+
Strip
+
All injection characters at the start of a field will be removed. ===foo will be stripped to foo.
+
Escape
+
If an injection character is detected, the field will be prepended with the InjectionEscapeCharacter
+that defaults to '. The field will be quoted if it is not already.
+
=one -> "'=one"
+
"=one" -> "'=one"
+
=one"two -> "'=one""two"
+
This option is disabled by default because the primary goal if this library is to read and write CSV
+files. If you are storing user entered data that you haven't sanitized yourself and you're letting
+it be accessed by people that may open in Excel/Sheets/etc, you might consider enabling this feature.
+The InjectionEscapeCharacter is not removed when reading.
+
When writing, you can throw an enumerable of class objects, dynamic objects, anonymous type objects, or pretty much
+anything else, and it will get written.
+
+
+