Bad PHP code sample: CSV Injection vulnerability

bad-code-sample-csv-injection-vulnerability.php

<?php

  public function write( $data, $columns ) {
          $is_test_mode_off = ! defined( 'AAL_TESTMODE' ) || ( defined( 'AAL_TESTMODE' ) && ! AAL_TESTMODE );

          if ( $is_test_mode_off ) {
                  header( 'Content-type: text/csv' );
                  header( 'Content-Disposition: attachment; filename="activity-log-export.csv"' );
          }

          $fp = fopen( 'php://output', 'w' );

          fputcsv( $fp, $columns );

          foreach ( $data as $row ) {
                  fputcsv( $fp, $row );
          }

          fclose( $fp );

          if ( $is_test_mode_off ) {
                  exit;
          }
  }