Sample XLSX file (spreadsheet)

Handle it in code

Each snippet below was run against this exact file with Python 3.14.4 and Node 24.15.0 when this page was built, and the output shown is what it printed.

Python

Check for macros before accepting or opening an Office upload. Modern files are ZIPs: VBA lives in vbaProject.bin (Microsoft) or a Basic folder (OpenDocument). Legacy .xls/.doc files are OLE2 containers that need a dedicated parser, such as oletools, to see inside.

import zipfile

OLE2 = bytes.fromhex("d0cf11e0a1b11ae1")

with open("spreadsheet.xlsx", "rb") as f:
    magic = f.read(8)
if magic == OLE2:
    print("legacy OLE2 file (.xls, .doc, .ppt, .msg): may carry VBA; inspect it with an OLE parser")
elif not zipfile.is_zipfile("spreadsheet.xlsx"):
    print("not an Office file")
else:
    with zipfile.ZipFile("spreadsheet.xlsx") as z:
        names = z.namelist()
        types = z.read("[Content_Types].xml").decode() if "[Content_Types].xml" in names else ""
    macros = [n for n in names if n.lower().endswith("vbaproject.bin") or n.startswith(("Basic/", "Scripts/"))]
    if macros or "macroEnabled" in types:
        print("contains macros:", ", ".join(macros) or "declared in [Content_Types].xml")
    else:
        print(f"no macro parts among {len(names)} entries")

Run against this file, it prints: no macro parts among 5 entries

Python

Text cells starting with =, +, - or @ are harmless inside Excel, but become live formulas when your app exports them to CSV. Scan the sheet XML directly: an .xlsx is a ZIP, and cell text is either inline or in the shared-strings table.

import re
import zipfile
import xml.etree.ElementTree as ET

M = "{http://schemas.openxmlformats.org/spreadsheetml/2006/main}"
TRIGGERS = ("=", "+", "-", "@", "\t", "\r")

def text_of(el):
    return "".join(t.text or "" for t in el.iter(M + "t"))

found = 0
with zipfile.ZipFile("spreadsheet.xlsx") as z:
    names = z.namelist()
    shared = []
    if "xl/sharedStrings.xml" in names:
        shared = [text_of(si) for si in ET.fromstring(z.read("xl/sharedStrings.xml")).iter(M + "si")]
    for sheet in sorted(n for n in names if re.fullmatch(r"xl/worksheets/sheet\d+\.xml", n)):
        for c in ET.fromstring(z.read(sheet)).iter(M + "c"):
            ref, kind, formula = c.get("r"), c.get("t"), c.find(M + "f")
            if formula is not None:
                print(f"{ref}: formula ={formula.text} (runs when the file is opened)")
                continue
            if kind == "s":
                text = shared[int(c.find(M + "v").text)]
            elif kind == "inlineStr":
                text = text_of(c)
            else:
                continue
            if text.startswith(TRIGGERS):
                print(f"{ref}: text {text!r} turns into a formula when exported to CSV")
                found += 1
print(f"{found} text cell{'s' * (found != 1)} to neutralise before a CSV export" if found else "no formula-like text")

Run against this file, it prints: B4: formula =SUM(B2:B3) (runs when the file is opened) C4: formula =SUMPRODUCT(B2:B3,C2:C3) (runs when the file is opened) no formula-like text