CSV Processing

A CSV record contains fields separated by a delimiter, often a comma. Quotes enclose fields containing delimiters or line breaks, and doubled quotes represent a quote inside a field. A logical record can therefore span multiple physical lines. fgetcsv() reads one parsed record from an open stream; str_getcsv() parses CSV already held in a string. The header is a convention rather than a universal requirement, so decide whether your importer requires one. Record the delimiter and expected character encoding for each supplier. A semicolon-separated European export will not parse correctly under a comma policy. PHP does not automatically convert every encoding to UTF-8. Convert supported encodings deliberately and reject unsupported files instead of silently corrupting customer names.

For contemporary PHP, call fgetcsv($handle, null, ',', '"', '') to choose comma, double-quote enclosure, and an empty proprietary escape character. Depending on the default escape argument is deprecated from PHP 8.4, so explicitly selecting it avoids a version-sensitive warning. The empty escape setting uses the common doubled-quote behavior without PHP's backslash escape convention. Use compatible settings for fputcsv() when you export data. Check fopen() and close the handle in finally. A blank line may produce a single null field rather than a normal complete record. Decide whether your import skips such records or reports them as invalid. Do not assume that end of file, an empty record, and a row full of empty strings are identical cases.

Read the header separately, then compare it with the required column names and permitted ordering. A supplier can misspell quantity, duplicate a column, or add an unsupported column. If you support arbitrary order, build a checked column-index map. Otherwise, requiring an exact header makes the contract clear. Strip a UTF-8 byte-order mark from the first header cell if your policy permits it. Before array_combine(), check that the record has the same number of fields as the header. Report a record number and field name for errors, without dumping sensitive rows into a public response. fgetcsv() returns strings or null for fields, not application-ready numbers. Parsing CSV grammar successfully does not establish that the row is valid.

Treat product codes and postal codes as strings even when they contain only digits; integer conversion would discard leading zeros. For stock, validate an integer range and compare the failure result strictly with false so zero is accepted. For prices, agree on a decimal representation and currency rather than relying on local spreadsheet formatting. A value like 1,200 may be text with a thousands separator, a decimal value under another locale, or an incorrectly quoted field. Define the accepted format in the import instructions. Validate dates using a known format with round-trip checks. Normalize whitespace only for fields where it is irrelevant. Keep the original record available for a private review report while writing only validated, normalized values to the database.

For a small import, validate every row before beginning database changes, then insert accepted rows in one transaction. For a large import, stream into a staging table and validate in batches so memory use stays bounded. Specify whether one bad row cancels the whole import or only that row. Neither policy is automatically correct; invoices usually need stronger all-or-nothing rules than a supplier's optional product descriptions. A stable supplier key helps make reruns idempotent rather than creating duplicates. Store a job identifier and counts for accepted, rejected, and skipped records. Do not report success after silently ignoring a database exception. Separate upload validation from CSV validation; a text-looking file can still contain malformed records or excessive data.

Use fputcsv() rather than joining fields by commas. If users will open the export in a spreadsheet, consider formula injection: cells beginning with characters such as = can be interpreted as formulas. Quoting a CSV field does not necessarily stop spreadsheet formula evaluation. Apply an export policy appropriate to the supported spreadsheet tools, often prefixing risky text with an apostrophe, and explain that this changes the exported representation. Preserve machine-to-machine data separately if exact text matters. For browser downloads send a controlled filename, text/csv content type, and attachment disposition before writing bytes. Stream results instead of building a giant array. Output encoding, delimiter, line endings, and formula policy are parts of the export contract.

Import a customer file with email, name, and joined_on columns. Write a header check, reject wrong field counts, validate email syntax, and parse the date under one documented format. The solution collects record-specific errors and inserts only after the chosen acceptance policy is satisfied. Add a rerun rule using a unique customer key. Test a quoted comma in a name, a doubled quote, a blank record, a duplicate header, and a malformed date. Then export rejected records with a spreadsheet-safe text policy so the error report itself does not execute submitted formulas. Keep database credentials and confidential rows out of browser error messages.

Review file handling, arrays, and form validation for streams and value checks.

The fgetcsv manual documents explicit escape settings and the PHP 8.4 deprecation.