function cleanCSV($string)
{
    $check = '/^[=@]/';
    if (!is_numeric($string)) {
        $check = '/^[=@+-]/';
    }

    return preg_replace($check, "", $string);
}
The software saves user-provided information into a Comma-Separated Value (CSV) file, but it does not neutralize or incorrectly neutralizes special elements that could be interpreted as a command when the file is opened by spreadsheet software.