CSV, comma-separated values, is a plain text table with fields separated by commas. Quoted fields can contain line breaks, so one record can span several lines. RFC 4180, published by the IETF in October 2005, describes the common format and registers the text/csv media type, but it is informational: separators, encodings, dates and number formats still differ between programs. Klarbon writes bank statement CSV files; other CSV conversions are planned.
What does RFC 4180 define?
| Rule | RFC 4180 |
|---|---|
| Records | separated by CRLF; quoted fields can contain line breaks |
| Header | an optional first line with field names |
| Fields | separated by commas, the same number in every record |
| Quotes | fields with commas, quotes or line breaks are enclosed in double quotes |
| Quotes inside a field | written twice |
| Media type | text/csv, with optional charset and header parameters |
What RFC 4180 does not fix: the meaning of the columns, the character encoding in practice, the date order and the decimal mark (IETF). Those come from the program that wrote the file.
What goes wrong with CSV?
| Problem | Why |
|---|---|
| Everything in one column | semicolon versus comma separator |
| Wrong amounts | decimal comma read as a thousands separator, or the other way round |
| Swapped dates | day-month or month-day order is not stated |
| Broken accents | the file is not in the encoding the program assumes |
| Formulas running | cells starting with =, +, - or @, known as CSV injection (OWASP) |
What does Klarbon do with CSV?
Klarbon writes CSV for bank statements, with semicolons and a decimal comma and layouts for some accounting tools; see bank CSV export. Reading CSV files, and writing invoices as CSV, are planned, not available yet. For figures you want to work with in a spreadsheet, the Excel workbook keeps dates and amounts typed.
Related
Frequently asked questions
Is there a standard for CSV files?
RFC 4180 describes the common format and registers the text/csv media type, but it is an informational document, not a strict standard. Many programs write CSV that differs from it.
Why do numbers and dates change when I open a CSV in a spreadsheet?
CSV stores everything as text. The spreadsheet guesses types using your computer's language settings, so it may read a decimal comma as a thousands separator, drop leading zeros or swap day and month. Import the file and set each column's type instead of opening it directly.
Why are all values in one column?
The file uses a different separator from the one your spreadsheet expects, often a semicolon where it expects a comma. Choose the actual field separator rather than assuming one from your language settings.
Can a CSV file be dangerous?
A cell that starts with =, +, - or @ can be run as a formula when a spreadsheet opens the file. OWASP calls this CSV injection. Programs that write CSV for spreadsheets should neutralise such cells.
Sources
- IETF, RFC 4180: Common Format and MIME Type for Comma-Separated Values (CSV) Files rfc-editor.org
- OWASP, CSV injection raw.githubusercontent.com