CSV RFC 4180 Rules

The grammar: records, fields, CRLF

RFC 4180's grammar fits in a paragraph. A file consists of records, each record a sequence of fields separated by commas; records are separated by CRLF — the two bytes 0x0D 0x0A, not the bare LF of Unix tooling — and the last record may or may not end with a trailing CRLF. Fields may or may not be quoted: quoting is conditional, not a style. The ABNF sketch is file = [header CRLF] record *(CRLF record); record = field *(comma field) — note the optional header inside the brackets.

id,name,score
1,Ada,99
2,Grace,98

record 1: id=1, name=Ada,   score=99
record 2: id=2, name=Grace, score=98

(each record ends with the two bytes CRLF;
the last one may legally omit them)

Quoting: the double quote is the whole escape system

A field is wrapped in double quotes when it must be, and the only way to put a double quote inside a quoted field is to double it — "" inside a quoted field means one literal quote. That is the entire escaping mechanism: no backslashes, no named entities, no second quoting character. Single quotes are ordinary data, and a stray space after a comma is part of the next field — the spec is explicit that spaces are preserved and must not be trimmed.

year,quote,note
1962,"she said ""look, no hands""","multi-word, no problem"

year   → 1962
quote  → she said "look, no hands"
note   → multi-word, no problem

Newlines and commas inside fields

Because quoted fields may contain line breaks, a CSV line is not a record: a naive splitter on \n corrupts any file with multi-line fields — which is why address blocks, notes columns and JSON-in-CSV payloads break naive importers. A conforming parser is a small state machine: inside quotes, commas and newlines are data; outside, they are separators. It cannot be written correctly with split() alone.

The same state machine settles the double-quote edge cases: a quote opening mid-value, an unterminated quote at end of file, doubled quotes at the very end of a field. These are exactly the cases RFC 4180's few rules were written to settle, and exactly where hand-rolled parsers disagree with one another — the source of most 'works in Excel, breaks in the importer' reports.

name,address
"Ada","12 St James Square,
London"
"Grace","1 Loop Rd"

record 1: Ada | 12 St James Square,
London
record 2: Grace | 1 Loop Rd

(the comma inside the address is data;
so is the CRLF inside the quotes)

CRLF, the optional header, and text/csv

Three details are fixed by the spec and routinely assumed otherwise. Records end with CRLF — though the final record may omit it, and every parser you use daily accepts bare LF. The first record may contain column names, but the grammar treats it as optional: a header is a convention the format supports, not a structure it requires, which is why tooling must be told — or must guess — whether row one is data. And the registered MIME type is text/csv — registered by RFC 4180 itself — with charset parameters left to the sender.

One more boundary the RFC draws firmly: the delimiter is the comma. Semicolon-separated files are a spreadsheet locale convention — common wherever the decimal comma is standard — not a variant the standard recognises. A compliant writer never guesses, and a compliant parser either sniffs the delimiter or is told, but the file itself carries no marker of which convention it follows.

Where real files drift from the standard

Real CSV predates the RFC, so divergence is the norm rather than the exception. Five drifts account for nearly every 'this CSV won't parse' incident:

Good tools surface these deviations instead of silently guessing. When a file matters — invoices, financial imports, anything a regulator may read — compare it against the grammar above and fix the drift at the source, rather than teaching every downstream parser the same exception.

Writing CSV that survives round-trips

The dependable producer's checklist follows directly from the grammar: quote uniformly — every field, or exactly the fields the rules require; both are compliant, but uniform is safer to read back — emit CRLF, write the header row, and encode UTF-8, accepting that a BOM is sometimes the price of a spreadsheet's recognition. Round-trip anything important: parse the file you just wrote, confirm every field matches the source data, then ship it. The recurring failure mode is always the same — a value containing the delimiter that the writer never quoted.