Overview

text/csv is the media type for Comma-Separated Values — tabular row/column data separated by commas (RFC 4180). It is widely used for spreadsheet exports and data interchange, and nearly every tool reads it.

Details

RFC 4180 sets the basics: fields separated by commas, records by CRLF; values containing commas, quotes, or newlines are wrapped in double quotes, and quotes inside a value are escaped by doubling (`""`). An optional header row may be the first line. Browsers usually treat it as a download, and `Content-Disposition: attachment; filename="data.csv"` sets the filename.

The biggest practical pitfalls are encoding and Excel. Even for UTF-8 CSV, Microsoft Excel opens the file in the system locale without a byte order mark (BOM), garbling non-ASCII text. So when Excel compatibility matters, prepend a UTF-8 BOM, or use a semicolon separator in some locales. Locale-dependent decimal and separator conventions can also misalign data.

Syntax

e.g. Content-Type: text/csv; charset=utf-8

File extensions

Notes

• CSV injection (formula injection): if a value starts with `=`, `+`, `-`, or `@`, Excel may execute it as a formula and run malicious commands; neutralize risky leading characters by prefixing an apostrophe.
• Prepending a UTF-8 BOM to Excel-targeted CSV is common practice to prevent garbled non-ASCII text.
• Ignoring the RFC's CRLF and quote-escaping rules shifts columns when values contain commas or newlines.

Related types

Related headers