diff -ru ../moodle.orig/grade/export/txt/grade_export_txt.php ./grade/export/txt/grade_export_txt.php
--- ../moodle.orig/grade/export/txt/grade_export_txt.php	2011-12-06 18:21:33.000000000 +0900
+++ ./grade/export/txt/grade_export_txt.php	2012-04-21 12:46:30.000000000 +0900
@@ -70,23 +70,27 @@
         $downloadfilename = clean_filename("$shortname $strgrades");
         header("Content-Disposition: attachment; filename=\"$downloadfilename.txt\"");
 
+        $OUTPUT = fopen('php://output', 'w');
 /// Print names of all the fields
-        echo get_string("firstname").$separator.
-             get_string("lastname").$separator.
-             get_string("idnumber").$separator.
-             get_string("institution").$separator.
-             get_string("department").$separator.
-             get_string("email");
+
+        $line = array();
+
+        array_push($line, get_string("firstname"));
+        array_push($line, get_string("lastname"));
+        array_push($line, get_string("idnumber"));
+        array_push($line, get_string("institution"));
+        array_push($line, get_string("department"));
+        array_push($line, get_string("email"));
 
         foreach ($this->columns as $grade_item) {
-            echo $separator.$this->format_column_name($grade_item);
+            array_push($line, $this->format_column_name($grade_item));
 
             /// add a feedback column
             if ($this->export_feedback) {
-                echo $separator.$this->format_column_name($grade_item, true);
+                array_push($line, $this->format_column_name($grade_item, true));
             }
         }
-        echo "\n";
+        fputcsv($OUTPUT, $line, $separator);
 
 /// Print all the lines of data.
         $geub = new grade_export_update_buffer();
@@ -96,20 +100,27 @@
 
             $user = $userdata->user;
 
-            echo $user->firstname.$separator.$user->lastname.$separator.$user->idnumber.$separator.$user->institution.$separator.$user->department.$separator.$user->email;
+            $line = array();
+
+            array_push($line, $user->firstname);
+            array_push($line, $user->lastname);
+            array_push($line, $user->idnumber);
+            array_push($line, $user->institution);
+            array_push($line, $user->department);
+            array_push($line, $user->email);
 
             foreach ($userdata->grades as $itemid => $grade) {
                 if ($export_tracking) {
                     $status = $geub->track($grade);
                 }
 
-                echo $separator.$this->format_grade($grade);
+                array_push($line, $this->format_grade($grade));
 
                 if ($this->export_feedback) {
-                    echo $separator.$this->format_feedback($userdata->feedbacks[$itemid]);
+                    array_push($line, $this->format_feedback($userdata->feedbacks[$itemid]));
                 }
             }
-            echo "\n";
+            fputcsv($OUTPUT, $line, $separator);
         }
         $gui->close();
         $geub->close();
diff -ru ../moodle.orig/grade/import/csv/index.php ./grade/import/csv/index.php
--- ../moodle.orig/grade/import/csv/index.php	2011-12-06 18:21:33.000000000 +0900
+++ ./grade/import/csv/index.php	2012-04-21 01:00:11.000000000 +0900
@@ -93,8 +93,7 @@
 if ($importcode = optional_param('importcode', '', PARAM_FILE)) {
     $filename = $CFG->tempdir.'/gradeimport/cvs/'.$USER->id.'/'.$importcode;
     $fp = fopen($filename, "r");
-    $headers = fgets($fp, GRADE_CSV_LINE_LENGTH);
-    $header = explode($csv_delimiter, $headers);
+    $header = fgetcsv($fp, GRADE_CSV_LINE_LENGTH, $csv_delimiter);
     fclose($fp);
 }
 
@@ -129,7 +128,7 @@
     $fp = fopen($filename, "r");
 
     // --- get header (field names) ---
-    $header = explode($csv_delimiter, fgets($fp, GRADE_CSV_LINE_LENGTH));
+    $header = fgetcsv($fp, GRADE_CSV_LINE_LENGTH, $csv_delimiter);
 
     // print some preview
     $numlines = 0; // 0 preview lines displayed
@@ -139,14 +138,14 @@
     echo '<tr>';
     foreach ($header as $h) {
         $h = clean_param($h, PARAM_RAW);
-        echo '<th>'.$h.'</th>';
+        echo '<th>'.htmlspecialchars($h).'</th>';
     }
     echo '</tr>';
     while (!feof ($fp) && $numlines <= $formdata->previewrows) {
-        $lines = explode($csv_delimiter, fgets($fp, GRADE_CSV_LINE_LENGTH));
+        $lines = fgetcsv($fp, GRADE_CSV_LINE_LENGTH, $csv_delimiter);
         echo '<tr>';
         foreach ($lines as $line) {
-            echo '<td>'.$line.'</td>';
+            echo '<td>'.htmlspecialchars($line).'</td>';
         }
         $numlines ++;
         echo '</tr>';
@@ -172,9 +171,10 @@
 
     if ($fp = fopen($filename, "r")) {
         // --- get header (field names) ---
-        $header = explode($csv_delimiter, clean_param(fgets($fp,GRADE_CSV_LINE_LENGTH), PARAM_RAW));
+        $header = fgetcsv($fp, GRADE_CSV_LINE_LENGTH, $csv_delimiter);
 
         foreach ($header as $i => $h) {
+            $h = clean_param($h, PARAM_RAW);
             $h = trim($h); $header[$i] = $h; // remove whitespace
         }
     } else {
@@ -220,14 +220,14 @@
     if ($fp = fopen($filename, "r")) {
 
         // read the first line makes sure this doesn't get read again
-        $header = explode($csv_delimiter, fgets($fp, GRADE_CSV_LINE_LENGTH));
+        $header = fgetcsv($fp, GRADE_CSV_LINE_LENGTH, $csv_delimiter);
 
         $newgradeitems = array(); // temporary array to keep track of what new headers are processed
         $status = true;
 
         while (!feof ($fp)) {
             // add something
-            $line = explode($csv_delimiter, fgets($fp, GRADE_CSV_LINE_LENGTH));
+            $line = fgetcsv($fp, GRADE_CSV_LINE_LENGTH, $csv_delimiter);
 
             if(count($line) <= 1){
                 // there is no data on this line, move on
