Use records, not arbitrary trees

CSV is a rectangular table. The cleanest JSON input is an array of objects with mostly consistent keys. Deeply nested data should be flattened intentionally or serialized inside a cell.

Respect CSV quoting

A production CSV parser must handle commas inside quoted fields, doubled quote escapes and line breaks inside cells. Splitting lines and commas manually fails on real exports.

  • Treat the first row as headers when importing
  • Preserve empty values
  • Use UTF-8
  • Review spreadsheet formula risks before sharing untrusted data

Validate the round trip

Convert a small representative sample in both directions and compare row counts, headers and special characters before processing a large dataset.

A quoted comma must stay in one cell

Paste this input into CSV to JSON. The comma inside the quoted name belongs to one field. The doubled quotes around review become ordinary quote characters, and the leading-zero id stays a string. This is why splitting the text on commas is not a CSV parser.

XXF uses the first row as headers, skips empty rows and leaves cells as strings. The string false does not become the boolean false; Boolean("false") would actually return true in JavaScript. Convert values only after checking them against a deliberate import schema.

Input · CSV to JSON
id,name,note
001,"Ada, Lin","Needs ""review"""
Expected output
[
  {
    "id": "001",
    "name": "Ada, Lin",
    "note": "Needs \"review\""
  }
]

Establish columns before exporting mixed records

For JSON to CSV, supply an array of objects with the same explicit columns. XXF serializes nested objects into cell text rather than expanding dotted paths, and null values become empty cells. CSV therefore cannot distinguish null from an empty string without an additional convention.

The current exporter derives columns from the first record. A key introduced only in a later record can be omitted, so normalize the records before exporting. For example, give every row id, name and note, including empty values, and compare the downloaded header and row count with the intended dataset.

CSV quoting is separate from spreadsheet formula handling. Untrusted cells beginning with formula markers may be evaluated by spreadsheet software. Review the destination's import settings and neutralization policy; a syntactically valid CSV file is not proof that opening it is safe.

  • Use consistent keys in every JSON record
  • Define how null and empty cells are represented
  • Keep identifiers as strings
  • Check formula-like cells before spreadsheet distribution
Primary references

Read the specification

RFC Editor · RFC 4180Common Format and MIME Type for CSV Files↗OWASPCSV Injection↗

Put the guide into practice

Open the related browser tools and test the workflow with a synthetic sample

JSON to CSV ↗CSV to JSON ↗JSON to HTML Table ↗JSON to Markdown Table ↗