diff --git a/src/m365/spo/commands/listitem/listitem-batch-set.spec.ts b/src/m365/spo/commands/listitem/listitem-batch-set.spec.ts
index 0497d2795e..103a638838 100644
--- a/src/m365/spo/commands/listitem/listitem-batch-set.spec.ts
+++ b/src/m365/spo/commands/listitem/listitem-batch-set.spec.ts
@@ -101,9 +101,9 @@ describe(commands.LISTITEM_BATCH_SET, () => {
assert.notStrictEqual(command.description, null);
});
- it('updates single item in batch to a sharepoint list retrieved by listUrl including empty values', async () => {
+ it('updates single item in batch to a sharepoint list retrieved by listUrl including empty values and special characters', async () => {
const csvContentHeadersEmptyValues = `Id,ContentType,Title,SingleChoiceField`;
- const csvContentLineEmptyValues = `10,Item,Title A,`;
+ const csvContentLineEmptyValues = `10,Item,Title A <>&",`;
const csvContentEmptyValues = `${csvContentHeadersEmptyValues}\n${csvContentLineEmptyValues}`;
const listServerRelativeUrl: string = urlUtil.getServerRelativePath(webUrl, listUrl);
const filterFields = ["InternalName eq 'ContentType'", "InternalName eq 'Title'", "InternalName eq 'SingleChoiceField'"];
@@ -136,6 +136,7 @@ describe(commands.LISTITEM_BATCH_SET, () => {
await command.action(logger, { options: { webUrl: webUrl, filePath: filePath, listUrl: listUrl, idColumn: idColumn, systemUpdate: true, verbose: true } } as any);
assert(postStub.called);
+ assert(postStub.args[0][0].data.includes('Title A <>&"'));
});
it('system updates single item in batch to a sharepoint list retrieved by id without user fields', async () => {
diff --git a/src/m365/spo/commands/listitem/listitem-batch-set.ts b/src/m365/spo/commands/listitem/listitem-batch-set.ts
index 9741baacdf..8d3415c5a7 100644
--- a/src/m365/spo/commands/listitem/listitem-batch-set.ts
+++ b/src/m365/spo/commands/listitem/listitem-batch-set.ts
@@ -219,7 +219,7 @@ class SpoListItemBatchSetCommand extends SpoCommand {
actionString += `${field.InternalName}${lookupMultiString.join('')}`;
break;
default:
- actionString += `${field.InternalName}${(row)[field.InternalName].toString()}`;
+ actionString += `${field.InternalName}${formatting.escapeXml((row)[field.InternalName].toString())}`;
break;
}
}