Handling Quoted Fields and Escaping in CSV

CSV Quoting and Escaping Rules

Proper handling of quoted fields is what separates a naive CSV parser from a robust one. RFC 4180 defines the quoting rules that most tools follow.

When quoting is required

A field must be enclosed in double quotes when it contains:

• The delimiter character (usually a comma)
• A double-quote character
• A newline (CR, LF, or CRLF)

Examples

name,description,price
"Smith, John","He said ""hello""",29.99
"Multiline
value",simple,9.99

This CSV has three tricky fields:

1. "Smith, John" — contains a comma, so it is quoted. The parser must not split on the internal comma.
2. "He said ""hello""" — contains double quotes, which are escaped by doubling them. The parsed value is He said "hello".
3. "Multiline\nvalue" — contains a newline. The parser must recognize that the line break is inside quotes and not treat it as a row separator.

Parsed JSON output

[
  {
    "name": "Smith, John",
    "description": "He said \"hello\"",
    "price": "29.99"
  },
  {
    "name": "Multiline\nvalue",
    "description": "simple",
    "price": "9.99"
  }
]

Common parsing mistakes

1. Splitting on all commas. A simple line.split(",") breaks whenever a quoted field contains commas. You need a state machine that tracks whether you are inside quotes.
2. Not handling doubled quotes. The sequence "" inside a quoted field represents a literal ", not the end of the field followed by an empty field.
3. Ignoring multiline fields. Many parsers assume one line = one row. Quoted fields can span multiple lines, requiring the parser to buffer incomplete rows.

Writing properly quoted CSV

When generating CSV output from JSON, apply these rules:

function escapeField(value, delimiter = ",") {
  const str = String(value);
  if (str.includes(delimiter) || str.includes('"') || str.includes("\n")) {
    return '"' + str.replace(/"/g, '""') + '"';
  }
  return str;
}

This ensures round-trip safety: any value can be written to CSV and read back without data loss.