No, a cell in this CSV table chart maker cannot execute HTML or JavaScript, in either the on-page preview or the exported SVG file. Every value you paste is treated as literal text, not as markup or script. The on-page preview is built from React text nodes that render characters but do not interpret HTML, so a cell that looks like <script>alert(1)</script> appears as those exact characters on the page. The downloaded image uses SVG rectangles and text where every string is XML-escaped before it is placed inside the file, so angle brackets, ampersands, and quotes become entities instead of tags. Invalid XML control characters are replaced rather than preserved as live markup. The tool accepts only comma-separated text, parses it with a state machine that rejects malformed input rather than guessing, and never executes the parsed content. Nothing leaves your browser — no labels, values, notes, names, or generated artwork are uploaded — so the question of whether a cell could trigger remote behavior does not arise. This article walks through what "executing HTML or JavaScript" actually means for a table cell, how the Table Chart Maker keeps the preview and the SVG inert, the exact steps to paste CSV with confidence, and the limits that reinforce the safety boundary.
What "Executing HTML or JavaScript" Means for a Table Cell
When people ask whether a cell can execute HTML or JavaScript, they are usually asking one of two things. First, will pasting something like <b>bold</b> into a CSV cell produce bold text in the rendered chart? Second, will pasting <script>alert('x')</script> trigger a script when the table is opened? In both cases the answer for this tool is no. CSV is a plain-text format that has no concept of formatting or scripting; it stores records of separated values, and any behavior beyond showing literal characters comes from the program that displays the CSV. A naive converter that builds an HTML string with innerHTML, for example, can interpret <b> as a bold tag and can execute embedded <script> tags, which is why some general-purpose converters are flagged as cross-site scripting risks. The Table Chart Maker avoids that path entirely: it does not assemble an HTML string from your CSV, it does not inject the resulting SVG into the document, and it does not wire up event handlers to parsed values.
How the Preview Keeps Cells as Plain Text
The on-page preview that you see after selecting Generate table chart is a real HTML table, so the structure is semantically meaningful — headers and body cells remain selectable and accessible. The choice of how those cells are populated is what makes the difference. The preview uses React text nodes rather than innerHTML or dangerouslySetInnerHTML. A text node is a leaf in the React render tree that holds a string; the string is written into the DOM as text, which means characters such as <, >, &, and " are inserted as their literal Unicode forms. They are not parsed as tag delimiters or entity references. A cell that contains <img src=x> therefore shows the angle brackets and the word "img" as visible characters rather than as an image element. There is no event handler bound to the cell content, no eval of the value, and no execution context in which the text could run as code.
How the Downloaded SVG Stays Inert
The file you download is a standalone SVG composed of <rect> rectangles for cell boxes and <text> elements for the values. Every string that goes into a <text> node passes through an XML escape before it is written. The escape replaces ampersands, angle brackets, quotation marks, and apostrophes with XML entities before the string is written. If a cell contains something like </text><script>...</script>, the closing tag becomes </text><script>...</script>, which closes nothing and starts nothing when the SVG is opened. Invalid XML control characters — non-printable bytes outside the allowed XML ranges — are replaced with safe substitutions rather than emitted verbatim. The resulting file carries an explicit width, height, viewBox, image role, and accessible label, and uses fixed Arial-style text and fixed colors so it is self-contained wherever you place it.
| Input in a CSV cell | What the on-page preview shows | What the exported SVG contains |
|---|---|---|
| <b>bold</b> | The literal characters <b>bold</b> with no formatting | <b>bold</b> inside a <text> element |
| <script>alert(1)</script> | The literal characters, no dialog appears | XML-escaped entities; no <script> tag is emitted |
| Said "hello" | Said "hello" (the cell value, parsed from "Said ""hello""") | Said "hello" as text content |
| Ada, A. | Ada, A. (one cell, quoted in the CSV as "Ada, A.") | Ada, A. as text content; the comma did not split the cell |
Paste CSV With Confidence: A Three-Step Walkthrough
- Paste CSV containing one header row and 1–50 data rows, quoting any cell that contains a comma or a line break. A field such as Ada, A. becomes "Ada, A." and a cell that contains a literal quote becomes "Said ""hello""". The parser reads commas, CRLF or LF line endings, quoted fields, embedded commas, and doubled quotes; it rejects rows whose shape does not match rather than silently fixing them.
- Select Generate table chart and compare the parsed HTML preview with the source data row by row. Confirm that the first row is treated as headings, that every heading contains text, and that each later row has exactly the same number of cells as the heading row. The preview is your visual confirmation of parsed values, not a spreadsheet, so you should not see formulas, sorting controls, filters, merged cells, or automatic totals — only literal text.
- Download the escaped SVG and inspect long or wide cells at the final display size before publishing. The image limits displayed cells to 30 Unicode characters to keep columns bounded; the HTML preview retains the full parsed value, so any visible truncation in the SVG is expected if a cell is longer than 30 characters. Check spelling, row alignment, color contrast in the destination, and final physical dimensions.
Limits That Reinforce the Safety Boundary
The safety properties above are paired with hard input limits that also make injection less feasible. The parser accepts two through ten columns and one through fifty body rows, with one nonempty header row. Every cell is capped at 120 Unicode characters, and the entire input is capped at 20,000 JavaScript characters. As a worked check: the largest legal table has 10 columns × 50 body rows, which is 500 cells; at the 120-character cell cap that would be 60,000 characters of cell text. The 20,000-character input limit is reached well before that, so the effective ceiling on a single cell drops to 20,000 ÷ 500 = 40 characters when the table is at its full width. Cells in narrower tables still respect the per-cell cap of 120 Unicode characters, so the bound is always the smaller of the two. That ceiling is what keeps the file manageable on ordinary devices and keeps the parse deterministic. Quoted fields must begin with a quote, and only a comma or line break may follow a closing quote, so a stray piece of "code-like" content outside the quoting rules is rejected up front rather than reinterpreted.
When You Want Cells to Behave Differently
There are cases where a different tool is the right answer. If you want numeric magnitude to dominate, a bar or pie chart communicates faster than a literal table. For tasks with start and end dates, a Gantt chart expresses duration in a way a small table cannot. If your source is Markdown, an existing HTML table, an XLSX workbook, a Google Sheets link, a remote URL, a JSON object, tab-delimited text, or semicolon-delimited regional CSV, the Table Chart Maker will not interpret it — convert the source to comma-separated UTF-8 text first, and follow a focused walkthrough such as the how to make a table chart from CSV guide if that is your starting point. The image also does not preserve every spreadsheet feature, may require horizontal scrolling for very wide tables, and can be hard to read when embedded at small sizes. Keep the source CSV as the authoritative editable record, and re-download the SVG only after comparing every preview cell with the source. Nothing is saved after the tab is closed.
For a deeper look, see Bar Chart Maker Example: Sample Data to SVG Walkthrough.