A CSV can contain formulas where you expected text
A form collects an answer and the system exports it to a CSV. So far, this looks like a data operation. But when someone opens the file in a spreadsheet, a value may be interpreted as a formula instead of text. This change of context is the risk OWASP calls CSV Injection.
Exporting is not a neutral copy
OWASP describes the problem when applications include untrusted input in CSV files. A field starting with an equals sign can trigger formula interpretation. The guide also identifies other initial characters, including plus, minus and at signs, and control characters.
There is no need to assume every answer is malicious. The point is to prevent the text from deciding how the program opening it behaves. A form comment, an imported name or a value received from an external system should be handled according to the destination format.
Quotation marks do not solve everything
Separators and quotation marks are part of the problem: a value can end up in a different cell if the CSV is constructed incorrectly. Joining fields with commas is not a sufficient exporter. Use a CSV library and check how values are interpreted too.
OWASP warns that some protections based on quoting or escaping may stop working in Excel after the file is saved and reopened. A simple transformation should therefore not be presented as universal protection across every program and workflow.
Define who will consume the file
A CSV for a person to read in a spreadsheet and one for another application to import do not necessarily have the same requirements. Adding a protective prefix may change the original data and affect a later import. Document this trade-off before applying it.
Test exports with separators, quotation marks, line breaks and formula-like starts, in an isolated environment without real data. Also test saving and reopening in the intended program. The aim is for text to remain text, without silently changing the meaning of the data or assuming a protection is safe before it has been tested.