| @@ -407,9 +407,9 @@ | ||
| 407 | 407 | private static function csvInjectionPrevent($value) |
| 408 | 408 | { |
| 409 | 409 | $formula = ['=', '-', '+', '@', "\t", "\r"]; |
| 410 | 410 | $valueFilter = preg_replace('/[\]["]/i', '', $value); |
| 411 | - if (in_array(substr($value, 0, 1), $formula, true)) { | |
| 411 | + if (in_array(substr($valueFilter, 0, 1), $formula, true)) { | |
| 412 | 412 | $valueFilter = "'" . trim($valueFilter); |
| 413 | 413 | } |
| 414 | 414 | |
| 415 | 415 | return $valueFilter; |
| @@ -445,9 +445,9 @@ | ||
| 445 | 445 | $value = trim($value); |
| 446 | 446 | |
| 447 | 447 | // Get label from fieldMap or use key |
| 448 | 448 | $label = $fieldMap[$childKey]['adminLbl'] ?? $childKey; |
| 449 | - $formattedPairs[] = "$label: " . self::unescapeString($value); | |
| 449 | + $formattedPairs[] = "$label: " . self::csvInjectionPrevent(self::unescapeString($value)); | |
| 450 | 450 | } |
| 451 | 451 | |
| 452 | 452 | $rows[] = implode(', ', $formattedPairs); |
| 453 | 453 | } |
