Add CSV escaping function

schlessera · schlessera · commit 48601274407b · 2025-05-06T17:51:44.000+02:00
diff --git a/php/utils.php b/php/utils.php
@@ -2032,3 +2032,26 @@ function get_hook_description( $hook ) {
 	}
 	return null;
 }
+
+/**
+ * Escape a value for CSV output.
+ *
+ * Values that start with the following characters are escaping with a single
+ * quote: =, +, -, @, TAB (0x09) and CR (0x0D).
+ *
+ * @param string $value Value to escape.
+ * @return string Escaped value.
+ */
+function escape_csv_value( $value ) {
+	if (
+		in_array(
+			substr( $value, 0, 1 ),
+			[ '=', '+', '-', '@', "\t", "\r" ],
+			true
+		)
+	) {
+		return "'{$value}";
+	}
+
+	return $value;
+}
diff --git a/tests/UtilsTest.php b/tests/UtilsTest.php
@@ -914,6 +914,34 @@ public static function dataParseUrl() {
 		];
 	}
 
+	/**
+	 * @dataProvider dataEscapeCsvValue
+	 */
+	public function testEscapeCsvValue( $input, $expected ) {
+		$this->assertEquals( $expected, Utils\escape_csv_value( $input ) );
+	}
+
+	public static function dataEscapeCsvValue() {
+		return [
+			// Values starting with special characters that should be escaped.
+			[ '=formula', "'=formula" ],
+			[ '+positive', "'+positive" ],
+			[ '-negative', "'-negative" ],
+			[ '@mention', "'@mention" ],
+			[ "\tindented", "'\tindented" ],
+			[ "\rcarriage", "'\rcarriage" ],
+
+			// Values that should not be escaped.
+			[ 'normal text', 'normal text' ],
+			[ 'text with = in middle', 'text with = in middle' ],
+			[ '123', '123' ],
+			[ '', '' ],
+			[ ' leading space', ' leading space' ],
+			[ 'trailing space ', 'trailing space ' ],
+			[ '=x==y=', "'=x==y=" ], // Only escapes when the first character is special
+		];
+	}
+
 	public function testReplacePathConstsAddSlashes() {
 		$expected = "define( 'ABSPATH', dirname( 'C:\\\\Users\\\\test\'s\\\\site' ) . '/' );";
 		$source   = "define( 'ABSPATH', dirname( __FILE__ ) . '/' );";
