用 Python 把 CSV 转成 HTML 报告：文本转义、多行字段与覆盖保护

python3 --version
mkdir csv-html-demo
cd csv-html-demo
cat > results.csv <<'CSV'
sample_id,note
001,中文结果
002,"alpha, beta"
003,"first line
second line"
004,<script>alert(1)</script>
CSV

"""Build a small standalone HTML table from UTF-8 CSV. Python 3.10+."""
import argparse
import csv
from html import escape
from pathlib import Path
import sys


def positive(value):
    number = int(value)
    if number < 1:
        raise argparse.ArgumentTypeError("must be at least 1")
    return number


def render(source, title, max_rows):
    with source.open(encoding="utf-8-sig", newline="") as file:
        reader = csv.reader(file, strict=True)
        header = next(reader, None)
        if not header or any(not name.strip() for name in header):
            raise ValueError("missing or empty column name")
        if len(set(header)) != len(header):
            raise ValueError("duplicate column name")
        parts = []
        for number, row in enumerate(reader, 1):
            if number > max_rows:
                raise ValueError(f"more than {max_rows} data records")
            if len(row) != len(header):
                raise ValueError(f"record {number}: expected {len(header)} fields, got {len(row)}")
            parts.append("<tr>" + "".join("<td>" + escape(cell) + "</td>" for cell in row) + "</tr>")
    headings = "".join('<th scope="col">' + escape(name) + "</th>" for name in header)
    safe_title = escape(title)
    document = f'''<!doctype html>
<html lang="en">
<head>
<meta charset="utf-8">
<meta name="viewport" content="width=device-width, initial-scale=1">
<title>{safe_title}</title>
<style>
body {{ font: 16px system-ui, sans-serif; margin: 2rem; color: #172033; }}
.scroll {{ overflow-x: auto; }}
table {{ border-collapse: collapse; }}
th, td {{ border: 1px solid #b8c2d1; padding: .5rem; text-align: left;
           white-space: pre-wrap; overflow-wrap: anywhere; max-width: 36rem; }}
th {{ background: #edf2f8; }}
</style>
</head>
<body>
<h1>{safe_title}</h1>
<p>Records: {len(parts)}</p>
<div class="scroll"><table>
<thead><tr>{headings}</tr></thead>
<tbody>{"".join(parts)}</tbody>
</table></div>
</body>
</html>
'''
    return document, len(parts)


def main():
    parser = argparse.ArgumentParser(description=__doc__, allow_abbrev=False)
    parser.add_argument("source", type=Path)
    parser.add_argument("output", type=Path)
    parser.add_argument("--title", default="CSV report")
    parser.add_argument("--max-rows", type=positive, default=1000)
    args = parser.parse_args()
    try:
        document, count = render(args.source, args.title, args.max_rows)
        payload = document.encode("utf-8")
        with args.output.open("xb") as file:
            file.write(payload)
    except (OSError, UnicodeError, csv.Error, ValueError) as exc:
        print(f"ERROR: {exc}", file=sys.stderr)
        return 1
    print(f"OK: {count} records -> {args.output}")
    return 0


if __name__ == "__main__":
    raise SystemExit(main())

python3 csv_to_html.py --help
python3 csv_to_html.py results.csv report.html --title 'Batch <A> & results'
python3 -m http.server 8000 --bind 127.0.0.1

python3 - <<'PY_CHECK'
from pathlib import Path
text = Path("report.html").read_text(encoding="utf-8")
assert "Records: 4" in text
assert "<td>001</td>" in text
assert "中文结果" in text
assert "alpha, beta" in text
assert "first line\nsecond line" in text
assert "&lt;script&gt;alert(1)&lt;/script&gt;" in text
assert "<script>" not in text
assert "Batch &lt;A&gt; &amp; results" in text
print("OK: records, text, and escaping")
PY_CHECK

python3 csv_to_html.py results.csv report.html
printf 'exit=%s\n' "$?"
python3 csv_to_html.py results.csv too-many.html --max-rows 3
printf 'exit=%s\n' "$?"
printf 'a,b\n1,2,3\n' > bad.csv
python3 csv_to_html.py bad.csv bad.html
printf 'exit=%s\n' "$?"