Delimited data conversion

Convert CSV to an HTML Table Without Executing Cell Markup

Convert CSV to an HTML Table Without Executing Cell Markup. Preserve field values with explicit parsing, encoding and a checked output round trip.

By Uddhav Gopani, FounderPublished 27 September 2026Updated 29 September 2026

To turn CSV into an HTML table, parse the records, use the first row as column headings and escape each field before inserting it into HTML. A comma inside a quoted field is data, not a new column. A cell containing angle brackets must remain text rather than becoming executable page markup.

Define a consistent table shape

The example requires a header row and the same field count in every record. It produces a caption, a table header and a table body. Column headings use scope=col so the relationship between headings and cells is explicit. The result is a simple review table, not a spreadsheet application.

Use a fixture with an identifier 00123, a comma in a name and a note such as <b>review</b>. That note should appear as literal text in the browser, not as a bold element. Test ampersands and quotation marks as well, because safe HTML output must preserve their intended text value.

Keep untrusted values out of markup structure

The script passes every header and cell through html.escape before placing it between fixed tags. It does not treat a cell as an HTML fragment, a link or a script. If a later feature creates hyperlinks, validate the destination separately rather than assuming escaped text makes every URL appropriate.

Do not build the table by joining unescaped CSV values into an HTML string. A value that looks like a tag can change the document, and script-like content can become active. Escaping preserves the value as text while the fixed template controls the table structure.

Check the generated page

Open the new HTML file and compare its headings, row count and selected cells with the parsed source. A browser may collapse ordinary whitespace visually, so a visual table is not a byte-preserving text export. Keep the CSV when exact spaces and line breaks are part of the data contract.

This example does not add sorting, filtering or pagination. A very large table can become slow and difficult to navigate, even if the file is valid HTML. For large datasets, provide a bounded preview or a purpose-built data view and keep a separate complete export.

Executable conversion example

import csv, html

with open("input.csv", encoding="utf-8-sig", newline="") as source:
    rows = list(csv.reader(source, strict=True))
if not rows or not rows[0] or any(len(row) != len(rows[0]) for row in rows):
    raise ValueError("Expected a header and consistent record widths")
head = "".join("<th scope=\"col\">" + html.escape(value) + "</th>"
               for value in rows[0])
body = "".join("<tr>" + "".join("<td>" + html.escape(value) + "</td>"
                for value in row) + "</tr>" for row in rows[1:])
document = ("<!doctype html><html lang=\"en\"><meta charset=\"utf-8\">"
            "<title>CSV review table</title><body><table>"
            "<caption>Converted records</caption><thead><tr>" + head +
            "</tr></thead><tbody>" + body + "</tbody></table></body></html>")
with open("output.html", "w", encoding="utf-8") as target:
    target.write(document)

Use a representative acceptance fixture

Begin with two different data records containing a leading-zero identifier, an embedded comma, a quotation mark, an empty field and a non-ASCII name when the destination supports it. Read the output with a parser for the destination format and compare the actual values, column order and record count. A save message or familiar extension does not establish that the records survived correctly.

Change the second fixture’s values rather than rerunning only the same sample. Include a malformed record and confirm that the conversion reports it instead of producing a misleading success. Keep the original unchanged and write the result to a separate path. Avoid exposing sensitive source values in public error logs.

Choose the format-aware operation

The Convert Text to CSV tool here works with already extracted plain text. It does not infer every structured file format or replace the Python parsers shown above. Use the operation whose input contract matches the actual source, and verify the result independently before importing it into another application.

Python reference

Python’s CSV module documentation explains the parser and writer dialect options. The published snippets and acceptance cases in this family are executed locally against disposable fixtures.