It's not going to -stay- in a google spreadsheet, though. You have to assume it will get loaded into some other system. there are opportunities to exploit that system, potentially. Kind of a 'stored' injection vulnerability.