Order export looks like the most harmless feature in an admin panel. Read some orders, write some rows, send a file. It is also one of the few places where text a stranger typed on your website ends up executing on your staff’s computers.
How a spreadsheet turns text into code
Excel and Google Sheets both treat a cell beginning with an equals sign, a plus, a minus or an at sign as a formula rather than text. That is exactly what you want when you type it. It is not what you want when the cell was filled by a customer.
Customer names, delivery addresses and order notes are all free text that lands in an export. A note that begins with an equals sign is not a note any more — it is an instruction, and it runs when a member of staff opens the file to check the day’s orders. The website itself is never touched, which is why this class of problem survives security reviews that only look at the site.
The fix is small and belongs at write time
Every value written to the file is checked, and anything starting with one of those characters is prefixed with a single quote, which tells the spreadsheet to treat the whole cell as text. It is applied to every column rather than the ones that look risky, because the set of fields a customer can influence grows every time someone adds a field to checkout.
Doing it at write time rather than on input matters too. The stored order should keep exactly what the customer typed — escaping belongs to the destination, and a CSV file has different rules from an HTML page or a database row.
The other half: who is allowed to export
An export endpoint hands over the store’s entire customer list in one request, so it is checked for the right capability before anything is read, and the submitted filters are sanitised into a known set of options rather than passed through to the query. Orders are fetched in batches so a wide date range produces a complete file instead of timing out halfway through and delivering a truncated one.
Key takeaways
- Any text a customer can type is untrusted at every destination, not only in the browser.
- CSV is an executable format in practice — treat it like one.
- Escape at write time and keep the stored record faithful to what was entered.
- Apply the rule to every column; the list of customer-influenced fields keeps growing.
- An export endpoint is a bulk data endpoint. Check capabilities before reading anything.
Related reading: custom order statuses that keep reports honest, custom mobile column visibility.
Running into a similar limitation in your own WooCommerce or WordPress store? Let’s Talk — ArtinTech Solution builds exactly this kind of custom store tooling.