Is it safe to use hyphen in shortcode attribute value?

For example:

[foo something="fo-bar"]
  • 1
    You asked about shortcode attribute values, however, you've accepted the answer that's about shortcode tag or name. Am I missing something? – Fayaz Aug 20 '18 at 15:28

It's safe, you won't have any problem using it, the only caution about Hyphens and Shortcodes comes from the Codex.

Take caution when using hyphens in the name of your shortcodes. In the following instance WordPress may see the second opening shortcode as equivalent to the first (basically WordPress sees the first part before the hyphen):


It all depends on which shortcode is defined first. If you are going to use hyphens then define the shortest shortcode first.

To avoid this, use an underscore or simply no separator:

  • 5
    Please note that the question is really about attribute values, not about shortcode naming. The OP accepted this answer, but it may confuse future visitors. – Fayaz Aug 20 '18 at 15:30
  • 2
    @Fayaz Thanks for the comment. I would have missed that. – fredsbend Aug 20 '18 at 22:36

tl;dr; Dash (hyphen) - is safe to use within shortcode attribute values.

Rules for Shortcode attribute values:

For shortcode attribute values, anything other than the following four is usually fine:

  1. There shouldn't be any square brackets [ or ], e.g. [foo bar='baa]z']
  2. There shouldn't be single quote within single quote, e.g. [foo bar='baa'z']
  3. There shouldn't be double quote within double quote, e.g. [foo bar="baa"z"]
  4. Back slash \ will be escaped.

So the following example shortcode attribute values are just fine:

// dash or hyphen is fine
[foo bar='baa-z']
// Double quote within single quote is fine
[foo bar='baa"z']
// single quote within double quote is fine
[foo bar="baa'z"]
// space is fine
[foo bar='baa z']
// use double back slash to get single back slash 
[foo bar='baa\\z'] 

Quote from codex:

Attribute values must never contain the following characters:

Square braces: [ ]

Quotes: " '

Unquoted values also must never contain spaces.

HTML characters < and > have only limited support in attributes.

The recommended method of escaping special characters in shortcode attributes is HTML encoding. Most importantly, any user input appearing in a shortcode attribute must be escaped or stripped of special characters.

Note that double quotes are allowed inside of single-quoted values and vice versa, however this is not recommended when dealing with user input.

The following characters, if they are not escaped within an attribute value, will be automatically stripped and converted to spaces:

No-break space: \xC2\xA0

Zero-width space: \xE2\x80\x8B

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.