From 0963d22572107fc418ca1a5c965e3249cfe762fb Mon Sep 17 00:00:00 2001
From: David Woloszyn <david.woloszyn@moodle.com>
Date: Thu, 27 Nov 2025 12:29:43 +1100
Subject: [PATCH] MDL-72744 core_grades: Escape formulas when exporting
 spreadsheets

---
 public/lib/csvlib.class.php   | 3 +++
 public/lib/excellib.class.php | 1 +
 public/lib/odslib.class.php   | 2 ++
 3 files changed, 6 insertions(+)

diff --git a/public/lib/csvlib.class.php b/public/lib/csvlib.class.php
index 88a76c9f69e..15f972cd350 100644
--- a/public/lib/csvlib.class.php
+++ b/public/lib/csvlib.class.php
@@ -449,6 +449,9 @@ class csv_export_writer {
             }
         }
         $delimiter = csv_import_reader::get_delimiter($this->delimiter);
+        foreach ($row as $key => $value) {
+            $row[$key] = \core\dataformat::escape_spreadsheet_formula($value);
+        }
         fputcsv($this->fp, $row, $delimiter, $this->csvenclosure, '\\');
     }
 
diff --git a/public/lib/excellib.class.php b/public/lib/excellib.class.php
index 812535df4ed..22b6aaad61b 100644
--- a/public/lib/excellib.class.php
+++ b/public/lib/excellib.class.php
@@ -207,6 +207,7 @@ class MoodleExcelWorksheet {
         $col += 1;
 
         $celladdress = CellAddress::fromColumnAndRow($col, $row + 1);
+        $str = \core\dataformat::escape_spreadsheet_formula($str);
 
         $this->worksheet->getStyle($celladdress)->getNumberFormat()->setFormatCode(NumberFormat::FORMAT_TEXT);
         $this->worksheet->getCell($celladdress)->setValueExplicit($str, DataType::TYPE_STRING);
diff --git a/public/lib/odslib.class.php b/public/lib/odslib.class.php
index 52ab06c7f12..1db27f077b5 100644
--- a/public/lib/odslib.class.php
+++ b/public/lib/odslib.class.php
@@ -164,6 +164,8 @@ class MoodleODSWorksheet {
         if (is_array($format)) {
             $format = new MoodleODSFormat($format);
         }
+        $str = \core\dataformat::escape_spreadsheet_formula($str);
+
         $this->data[$row][$col]->value = $str;
         $this->data[$row][$col]->type = 'string';
         $this->data[$row][$col]->format = $format;