ShareYourGroupShareYourGroupTest Data Generator

CSV, JSON and SQL test files

The same rows can be written three ways. Each has traps.

CSV

RFC 4180 describes the common CSV format. Each record is on its own line, ended by CRLF. Fields that contain line breaks, double quotes or commas must be enclosed in double quotes, and a double quote inside a field is written as two double quotes. A header line with the field names may come first. The generator follows these rules, and we checked by reading the output with Python's csv module, including text with commas, quotes and a line break.

The formula risk

OWASP's page on CSV injection explains that when a spreadsheet program such as Excel or LibreOffice opens a CSV, a cell that starts with = is read as a formula. It lists =, +, -, @, tab, carriage return, line feed and full-width variants of the first four as the characters to avoid at the start of a cell, and warns that Excel may strip the usual quote escapes when a file is saved and opened again. The generator makes no value that begins with these characters, and the test checks that on 500 rows. If you export real or user-made text to CSV, check this yourself.

JSON

JSON keeps types: numbers are numbers, true and false are real booleans, and text is quoted. The generator's JSON output is a list of objects, one per row, and we read it back with Python and compared it with the rows.

SQL

The SQL output is a CREATE TABLE followed by one INSERT per row, with text in single quotes and a single quote inside text doubled, which is how SQL writes it. Booleans become 1 and 0. We ran the whole file in a real SQLite database and compared the rows with the JSON: they matched. The table name is cleaned to letters, digits and underscores.

Tips

  1. Open a CSV in a text editor first if you are unsure what it holds.
  2. For Excel, import it with "From Text/CSV" and choose UTF-8, so that accented and Hindi letters show right.
  3. Load SQL into a test database only, never into production.
Why CRLF in CSV?

RFC 4180 says records are separated by CRLF. Many programs accept plain line feeds too.

Is the UUID-shaped text a real UUID?

It has the shape of a version 4 UUID but comes from a seeded generator, so it is not random enough for security.

Sources

  • RFC 4180: Common Format and MIME Type for CSV Files (datatracker.ietf.org/doc/html/rfc4180)
  • OWASP: CSV Injection (owasp.org/www-community/attacks/CSV_Injection)

Read on 14 November 2026.

This is an independent guide. It is not connected with the IETF, OWASP or any company named here. Facts were read on 14 November 2026 from the pages named on each page. All people, e-mail addresses and amounts made by the generator are invented.