Language: PHP
Label: safe
CWE: CWE-1236 \u2014 Improper Neutralization of Formula Elements in a CSV File
The product saves user-provided information into a Comma-Separated Value (CSV) file, but it does not neutralize or incorrectly neutralizes special elements that could be interpreted as a command when the file is opened by a spreadsheet product.

Code:
        foreach ($data as $row) {
            $csvRow = array_map(['phpMyFAQ\Report', 'sanitize'], $row);
            $actual[] = implode(',', $csvRow);
        }