Newlines in values will corrupt CSV export.

If a value contains newlines it will corrupt the CSV export because they do not get quoted and end up interpreted as the start of a new record.

Also, though less serious, a value with leading or trailing spaces will lose that spacing in the export process without the value being enclosed in quotes.

There's no such thing as an official CSV specification but a general rule is that all values may be quoted even if unnecessarily. I think the safest, easiest way to solve this problem is to quote every value.

To do so, I've changed function _webform_report_format_csv_column in webform_report.inc from the following:

function _webform_report_format_csv_column($value, $delim) {

  // if value contains a delimiter, it should be enclosed in quotes
  if (strpos($value, $delim) !== FALSE) {
      // if value contains quotes, double the quotes
      if (strpos($value, '"')) {
        return '"' . str_replace('"', '""', $value) . '"';
      }
      else {
        return '"' . $value . '"';
      }
  }
  return $value;
}

into:

function _webform_report_format_csv_column($value, $delim) {

  // if value contains quotes, double the quotes
  if (strpos($value, '"')) {
    return '"' . str_replace('"', '""', $value) . '"';
  }
  else {
    return '"' . $value . '"';
  }
  return $value;
}

So far it seems to work well.

My only problem is that when opened in Excel (after exporting with either Text or Excel option) those newlines appear as unknown characters (rectangle with question mark inside). I know that Excel can handle newlines in a CSV, so this must be an encoding issue. Unfortunately I'm not well versed enough in encoding to know how to solve this. Hopefully someone has a suggestion about the encoding, but even so this is better than a corrupted CSV.

Attached a patch against 6.x-2.0 with the above change.