Spreadsheet Security Checklist

Validate before reading#

$upload = MnbExcel::validateUpload($_FILES['spreadsheet'], [
    'allowed_extensions' => ['xlsx', 'xls', 'ods', 'csv', 'tsv'],
    'max_size_mb' => 100,
    'validate_package' => true,
    'max_zip_entries' => 5000,
    'max_uncompressed_size_mb' => 500,
]);

if (($upload['valid'] ?? false) !== true) {
    throw new RuntimeException('Upload validation failed.');
}

Apply formula and text safety policies#

$workbook
    ->escapeFormulaLikeText()
    ->maxCellTextLength(32767, 'truncate')
    ->controlCharPolicy('remove')
    ->formulaPolicy('deny-untrusted');

Use encryption for confidentiality#

Workbook or worksheet protection is an editing control, not encryption. Use Agile password-to-open encryption when the workbook contents must remain confidential outside the application.

Review the full deployment checklist#

• Store uploads and exports outside the public web root.
• Generate safe filenames and never concatenate user paths.
• Restrict external hyperlink protocols.
• Set file-size, package-entry, XML-depth, worksheet, row, cell, and shared-string limits.
• Do not log workbook passwords, SMTP credentials, or database credentials.
• Delete temporary decrypted and generated files.
• Return safe errors; keep stack traces server-side.
• Run large or untrusted work in a separate process with time and memory limits.