What to do
Untrusted text starting with spreadsheet formula characters can be interpreted as a formula when opened in some spreadsheet applications. Review supplier-provided text and import descriptive fields as data using the destination’s supported controls. CSV quotation alone is not a universal safety guarantee.
This issue concerns the receiving spreadsheet’s interpretation, even when the export accurately preserves the source text.
Two worked review cases
These cases are fictional teaching data, not measured extraction results. Use the source excerpts to practise deciding what belongs in the reviewed output.
| Case | Fictional source excerpt | Review decision |
|---|---|---|
| Formula-looking description | A source description begins with = followed by an expression | Treat it as untrusted data and verify safe text import in the destination. |
| Ordinary negative amount | Amount column contains -15.00 | Review according to its numeric field role rather than deleting all leading minus signs. |
Suggested review columns
| Column | Definition or instruction |
|---|---|
| Source text | Exact untrusted description or identifier before import. |
| Destination type | Text/data interpretation selected in the receiving tool. |
| Review finding | Whether the value could be interpreted as a formula. |
These are suggested staging-sheet columns. Printed facts can inform field descriptions in Parzable’s Schemas view; source references, review statuses, and decisions must be supplied by your own review process.
A practical review sequence
- Identify which columns contain untrusted free text.
- Use supported text-import controls and inspect the resulting cell behavior.
- Test the destination workflow with harmless sample values before client data.
Errors to avoid
- Do not assume enclosing a value in CSV quotes prevents formula interpretation.
- Do not modify legitimate amounts indiscriminately while handling descriptive text.
Use the case worksheet with a small sample
Download this page’s worked-case worksheet. It contains the two fictional cases above and a blank row for your own review exercise. Keep any real source documents in your agreed storage process.
For the broader product workflow, see the related guide. Parzable accepts PDF/image inputs and downloads CSV. Suggested structures here are review targets; nested item rows, automatic approvals, and destination integrations are not guaranteed.
Reference and scope
Further reading: CSV formula injection: OWASP. External documentation provides background for the topic; it does not establish Parzable’s implementation or performance. References checked 18 October 2026.
Examples and review decisions on this page are authored illustrations. Confirm unresolved business, payment, or accounting decisions through the responsible reviewer.
Put the workflow to work
Try your own invoice in Parzable
Create an account, define a schema, and test a small sample. Review extracted values before using them. See current plans and page allowances.
Try Parzable