diff --git a/adm/member_list_exel_export.php b/adm/member_list_exel_export.php
index ffaebf3f1..33c7dcbf0 100644
--- a/adm/member_list_exel_export.php
+++ b/adm/member_list_exel_export.php
@@ -233,7 +233,11 @@ function member_export_get_data($params)
     while ($row = sql_fetch_array($result)) {
         $rowData = [];
         foreach ($fields as $field) {
-            $rowData[] = isset($row[$field]) ? $row[$field] : '';
+            if (isset($row[$field])) {
+                $rowData[] = function_exists('csv_safe_cell') ? csv_safe_cell($row[$field]) : $row[$field];
+            } else {
+                $rowData[] = '';
+            }
         }
         $excelData[] = $rowData;
     }
diff --git a/adm/shop_admin/orderdeliveryexcel.php b/adm/shop_admin/orderdeliveryexcel.php
index fc86ed4f2..f7c10b763 100644
--- a/adm/shop_admin/orderdeliveryexcel.php
+++ b/adm/shop_admin/orderdeliveryexcel.php
@@ -30,17 +30,17 @@ if(! function_exists('column_char')) {
     $rows = array();
 
     for($i=1; $row=sql_fetch_array($result); $i++) {
-        $rows[] = 
-                    array(' '.$row['od_id'], 
-                          $row['od_name'], 
-                          ' '.$row['od_tel'], 
-                          ' '.$row['od_hp'], 
-                          $row['od_b_name'], 
-                          ' '.$row['od_b_tel'], 
-                          ' '.$row['od_b_hp'], 
-                          print_address($row['od_b_addr1'], $row['od_b_addr2'], $row['od_b_addr3'], $row['od_b_addr_jibeon']),
-                          $row['od_delivery_company'],
-                          $row['od_invoice']);
+        $rows[] =
+                    array(' '.$row['od_id'],
+                          function_exists('csv_safe_cell') ? csv_safe_cell($row['od_name']) : $row['od_name'],
+                          ' '.$row['od_tel'],
+                          ' '.$row['od_hp'],
+                          function_exists('csv_safe_cell') ? csv_safe_cell($row['od_b_name']) : $row['od_b_name'],
+                          ' '.$row['od_b_tel'],
+                          ' '.$row['od_b_hp'],
+                          function_exists('csv_safe_cell') ? csv_safe_cell(print_address($row['od_b_addr1'], $row['od_b_addr2'], $row['od_b_addr3'], $row['od_b_addr_jibeon'])) : print_address($row['od_b_addr1'], $row['od_b_addr2'], $row['od_b_addr3'], $row['od_b_addr_jibeon']),
+                          function_exists('csv_safe_cell') ? csv_safe_cell($row['od_delivery_company']) : $row['od_delivery_company'],
+                          function_exists('csv_safe_cell') ? csv_safe_cell($row['od_invoice']) : $row['od_invoice']);
     }
 
     $data = array_merge(array($headers), $rows);
diff --git a/adm/shop_admin/orderprintresult.php b/adm/shop_admin/orderprintresult.php
index a88ed0d1a..bca769325 100644
--- a/adm/shop_admin/orderprintresult.php
+++ b/adm/shop_admin/orderprintresult.php
@@ -118,21 +118,21 @@ if ($csv == 'csv')
         }
 
         echo '"\''.$row['od_b_zip1'].$row['od_b_zip2'].'"\''.',';
-        echo '"'.$pull_address.'"'.',';
-        echo '"'.$row['od_b_name'].'"'.',';
+        echo '"'.(function_exists('csv_safe_cell') ? csv_safe_cell($pull_address) : $pull_address).'"'.',';
+        echo '"'.(function_exists('csv_safe_cell') ? csv_safe_cell($row['od_b_name']) : $row['od_b_name']).'"'.',';
         //echo '"'.multibyte_digit((string)$row[od_b_tel]).'"'.',';
         //echo '"'.multibyte_digit((string)$row[od_b_hp]).'"'.',';
         echo '"'.conv_telno($row['od_b_tel']) . '"'.',';
         echo '"'.conv_telno($row['od_b_hp']) . '"'.',';
-        echo '"'.preg_replace("/\"/", """, $row['it_name']) . '"'.',';
+        echo '"'.(function_exists('csv_safe_cell') ? csv_safe_cell(preg_replace("/\"/", """, $row['it_name'])) : preg_replace("/\"/", """, $row['it_name'])) . '"'.',';
         echo '"'.$row['ct_qty'].'"'.',';
-        echo '"'.$row['ct_option'].'"'.',';
+        echo '"'.(function_exists('csv_safe_cell') ? csv_safe_cell($row['ct_option']) : $row['ct_option']).'"'.',';
         echo '"'.$ct_send_cost.'"'.',';
         echo '"\''.$row['it_id'].'\'"'.',';
         echo '"\''.$row['od_id'].'\'"'.',';
-        echo '"'.$row['od_invoice'].'"'.',';
+        echo '"'.(function_exists('csv_safe_cell') ? csv_safe_cell($row['od_invoice']) : $row['od_invoice']).'"'.',';
         //echo '"'.preg_replace("/\"/", """, preg_replace("/\n/", "", $row[od_memo])).'"';
-        echo '"'.preg_replace("/\"/", """, $row['od_memo']).'"';
+        echo '"'.(function_exists('csv_safe_cell') ? csv_safe_cell(preg_replace("/\"/", """, $row['od_memo'])) : preg_replace("/\"/", """, $row['od_memo'])).'"';
         echo "\n";
     }
     if ($i == 0)
@@ -217,18 +217,18 @@ if ($csv == 'xls')
             }
 
             $rows[] = array(' '.$row['od_b_zip1'].$row['od_b_zip2'],
-                            $pull_address,
-                            $row['od_b_name'], 
-                            ' '.conv_telno($row['od_b_tel']), 
-                            ' '.conv_telno($row['od_b_hp']), 
-                            preg_replace("/\"/", """, $row['it_name']), 
-                            ' '.$row['ct_qty'], 
-                            $row['ct_option'], 
+                            function_exists('csv_safe_cell') ? csv_safe_cell($pull_address) : $pull_address,
+                            function_exists('csv_safe_cell') ? csv_safe_cell($row['od_b_name']) : $row['od_b_name'],
+                            ' '.conv_telno($row['od_b_tel']),
+                            ' '.conv_telno($row['od_b_hp']),
+                            function_exists('csv_safe_cell') ? csv_safe_cell(preg_replace("/\"/", """, $row['it_name'])) : preg_replace("/\"/", """, $row['it_name']),
+                            ' '.$row['ct_qty'],
+                            function_exists('csv_safe_cell') ? csv_safe_cell($row['ct_option']) : $row['ct_option'],
                             $ct_send_cost,
                             ' '.$row['it_id'],
                             ' '.$row['od_id'],
                             ' '.$row['od_invoice'],
-                            preg_replace("/\"/", """, $row['od_memo']));
+                            function_exists('csv_safe_cell') ? csv_safe_cell(preg_replace("/\"/", """, $row['od_memo'])) : preg_replace("/\"/", """, $row['od_memo']));
         }
 
         $data = array_merge(array($headers), $rows);
diff --git a/adm/sms_admin/num_book_file_download.php b/adm/sms_admin/num_book_file_download.php
index 5f5e875ea..255076bb4 100644
--- a/adm/sms_admin/num_book_file_download.php
+++ b/adm/sms_admin/num_book_file_download.php
@@ -46,7 +46,7 @@ for($i=1; $res=sql_fetch_array($qry); $i++)
 
     if ($no_hp && $res['bk_hp'] != '' && !$hp) continue;
 
-    $rows[] = array($res['bk_name'], ' '.$hp);
+    $rows[] = array(function_exists('csv_safe_cell') ? csv_safe_cell($res['bk_name']) : $res['bk_name'], ' '.$hp);
 }
 
 $data = array_merge(array($headers), $rows);
diff --git a/lib/common.lib.php b/lib/common.lib.php
index ad7dfb7fb..89e5185d3 100644
--- a/lib/common.lib.php
+++ b/lib/common.lib.php
@@ -213,6 +213,25 @@ if (!function_exists('get_js_safe_string')) {
 }
 
 
+// CSV/Excel 셀에 출력할 값을 안전하게 변환 (수식 인젝션 방지)
+// 값이 = + - @ TAB CR 로 시작하면 작은따옴표를 prefix 해 수식 해석을 차단
+if (!function_exists('csv_safe_cell')) {
+    function csv_safe_cell($v)
+    {
+        if ($v === null || $v === '') {
+            return $v;
+        }
+        $s = (string)$v;
+        $first = substr($s, 0, 1);
+        if ($first === '=' || $first === '+' || $first === '-' || $first === '@'
+            || $first === "\t" || $first === "\r") {
+            return "'" . $s;
+        }
+        return $s;
+    }
+}
+
+
 // 경고메세지를 경고창으로
 function alert($msg='', $url='', $error=true, $post=false)
 {