Is it safe to use hyphen in shortcode attribute value?
It's safe, you won't have any problem using it, the only caution about Hyphens and Shortcodes comes from the Codex.
Take caution when using hyphens in the name of your shortcodes. In the following instance WordPress may see the second opening shortcode as equivalent to the first (basically WordPress sees the first part before the hyphen):
It all depends on which shortcode is defined first. If you are going to use hyphens then define the shortest shortcode first.
To avoid this, use an underscore or simply no separator:
tl;dr; Dash (hyphen)
-is safe to use within shortcode attribute values.
For shortcode attribute values, anything other than the following four is usually fine:
\will be escaped.
So the following example shortcode attribute values are just fine:
// dash or hyphen is fine [foo bar='baa-z'] // Double quote within single quote is fine [foo bar='baa"z'] // single quote within double quote is fine [foo bar="baa'z"] // space is fine [foo bar='baa z'] // use double back slash to get single back slash [foo bar='baa\\z']
Attribute values must never contain the following characters:
Unquoted values also must never contain spaces.
>have only limited support in attributes.
The recommended method of escaping special characters in shortcode attributes is HTML encoding. Most importantly, any user input appearing in a shortcode attribute must be escaped or stripped of special characters.
Note that double quotes are allowed inside of single-quoted values and vice versa, however this is not recommended when dealing with user input.
The following characters, if they are not escaped within an attribute value, will be automatically stripped and converted to spaces: