Code review: an export method builds a cache key with customer.Name.ToLower() + "_" + date.ToString(), checks status.ToUpper() == "ACTIVE", validates emails with IndexOf("@") > 0, appends CSV rows with result += line, truncates names with Substring(0, 50), calls name.Trim() without assigning it, and logs with $"Exported {count} rows". What is wrong and how would you rewrite it?

1. Why culture leaks into identifiers

ToLower(), ToUpper(), ToString() on numbers and dates, IndexOf(string), StartsWith(string) and string.Compare all consult CultureInfo.CurrentCulture when you don't pass a culture or comparison. In ASP.NET Core with request localisation, the current culture can even differ per request, so a cache key produced in one request may not match the key produced in another. Identifiers and keys must be built with ordinal operations and the invariant culture — or better, from values that are already culture-free (IDs, enums, ISO dates).

2. Case mapping rules

• ToLowerInvariant() / ToUpperInvariant() use invariant simple case mapping: stable, but they still allocate.
• For comparisons, case-insensitive comparers (StringComparer.OrdinalIgnoreCase) avoid allocation and are faster.
• Microsoft recommends normalising to upper-case invariant when you must store a case-folded form, because a few characters round-trip better through upper case.
• For keys, consider not case-folding at all: use IDs.

3. Email validation reality

The RFC 5322 grammar is enormous; regexes that try to implement it are either wrong or vulnerable to ReDoS. Practical layers:

1. Trim and length-limit (254 characters).
2. Basic structure: MailAddress.TryCreate (.NET 5+), or [EmailAddress] / FluentValidation's EmailAddress() (which in recent versions only checks for an @ with text either side, by design).
3. Normalise the domain to lower case (IdnMapping for internationalised domains); the local part is technically case-sensitive.
4. Confirm ownership by sending a verification link — the only real validation.

4. CSV is a format, not string concatenation

RFC 4180 rules: fields containing a comma, quote, CR or LF must be enclosed in double quotes, and quotes inside are doubled. Additionally, spreadsheet applications interpret fields starting with =, +, -, @ (and tab/CR) as formulas, which allows CSV injection (data exfiltration via =HYPERLINK(...), or DDE attacks in older Excel). OWASP recommends prefixing such values with a single quote and quoting the field. Libraries like CsvHelper handle quoting, culture (CsvConfiguration(CultureInfo.InvariantCulture)) and streaming.

5. Streaming vs building

For exports, the cost model of building a string is:

• += → O(n²) time, n intermediate strings, final string on the LOH (> 85 KB).
• StringBuilder → O(n) time but still the whole export in memory, plus one final large string copy.
• StreamWriter over the response stream → O(n) time, constant memory (buffer size), and the client starts downloading immediately.

In ASP.NET Core, return the export by writing to Response.Body (or Results.Stream with a callback); for very large exports, generate to Azure Blob Storage and return a link.

6. Safe truncation

Substring(0, n) fails three ways: short strings (exception), null (NRE), and splitting surrogates or combining sequences (invalid or garbled text). Options:

• value[..Math.Min(value.Length, n)] fixes the exception but not Unicode splitting.
• Truncate by text elements (StringInfo.SubstringByTextElements) for user-visible limits.
• Truncate by encoded bytes for byte-limited storage, backing off to a valid boundary (Rune.DecodeLastFromUtf8 / Utf8.FromUtf16 with OperationStatus).
• Decide whether truncation is acceptable at all — often it is better to reject over-long input at validation time.

7. Structured logging

ILogger providers treat the message template as an event type and the placeholders as properties. Application Insights stores them as customDimensions; Seq and Elastic index them. [LoggerMessage] source generation:

• checks IsEnabled before doing any work,
• passes strongly typed values (no boxing, no object[]),
• caches the parsed template,
• produces an EventId for alerting.

Analyser CA2254 warns when the template is not a constant (e.g. interpolated), and CA1848 suggests LoggerMessage for performance.

Try it yourself

1. Run the original key code under tr-TR and en-US cultures and compare keys.
2. Feed names like O'Brien, Jr., =HYPERLINK("http://x"), and an emoji nickname through the original and rewritten exporter, then open the CSV in Excel.
3. Measure memory with dotnet-counters while exporting 1 million rows with +=, StringBuilder and streaming.
4. Enable the analysers listed above and count the warnings in the original code.

using System.Globalization;
using System.Net.Mail;
using System.Text;
using Microsoft.Extensions.Logging;

namespace Strings;

public enum CustomerStatus { Unknown = 0, Active = 1, Suspended = 2 }
public sealed record Customer(int Id, string Name, string Email, CustomerStatus Status);
public sealed record Order(decimal Total, DateOnly Date);

public static partial class ExportLog
{
    [LoggerMessage(Level = LogLevel.Information, Message = "Exported {Count} rows for customer {CustomerId}")]
    public static partial void Exported(ILogger logger, int count, int customerId);
}

public sealed class OrderExporter(ILogger<OrderExporter> logger)
{
    public static string CacheKey(Customer c, DateOnly date) =>
        string.Create(CultureInfo.InvariantCulture, $"export:{c.Id}:{date:yyyy-MM-dd}");   // no PII, invariant

    public async Task<bool> ExportAsync(Customer customer, IReadOnlyList<Order> orders, Stream output, CancellationToken ct)
    {
        ArgumentNullException.ThrowIfNull(customer);
        if (customer.Status != CustomerStatus.Active) return false;                // enum, not ToUpper()
        if (!MailAddress.TryCreate(customer.Email, out _)) return false;          // real validation

        string name = Truncate(customer.Name.Trim(), 50);                         // assigned, safe truncation

        await using var writer = new StreamWriter(output, new UTF8Encoding(true), leaveOpen: true); // BOM for Excel
        foreach (var o in orders)
        {
            await writer.WriteLineAsync(string.Create(CultureInfo.InvariantCulture,
                $"{Csv(name)},{o.Total:F2},{o.Date:yyyy-MM-dd}"));
        }

        ExportLog.Exported(logger, orders.Count, customer.Id);                    // structured, no PII
        return true;
    }

    private static string Truncate(string value, int max)
    {
        if (value.Length <= max) return value;
        var info = new StringInfo(value);
        return info.LengthInTextElements <= max ? value : info.SubstringByTextElements(0, max);
    }

    private static string Csv(string field)
    {
        if (field.Length > 0 && "=+-@".Contains(field[0])) field = "'" + field;    // formula injection guard
        return field.AsSpan().IndexOfAny(",\"\r\n") >= 0
            ? $"\"{field.Replace("\"", "\"\"", StringComparison.Ordinal)}\""
            : field;
    }
}