WordPress at Your Fingertips
function is not described

WC_CSV_Exporter::escape_data() public WC 3.1.0

Escape a string to be used in a CSV context

Malicious input can inject formulas into CSV files, opening up the possibility for phishing attacks and disclosure of sensitive information.

Additionally, Excel exposes the ability to launch arbitrary commands through the DDE protocol.

{} It's a method of the class: WC_CSV_Exporter{}

No Hooks.

Return

String.

Usage

$WC_CSV_Exporter = new WC_CSV_Exporter();
$WC_CSV_Exporter->escape_data( $data );
$data(string) (required)
CSV field to escape.

Notes

Changelog

Since 3.1.0 Introduced.

Code of WC_CSV_Exporter::escape_data() WC 5.9.0

public function escape_data( $data ) {
	$active_content_triggers = array( '=', '+', '-', '@' );

	if ( in_array( mb_substr( $data, 0, 1 ), $active_content_triggers, true ) ) {
		$data = "'" . $data;
	}

	return $data;
}