Shortcode attribute value with dash (hyphen)

Question

Is it safe to use hyphen in shortcode attribute value?

For example:

[foo something="fo-bar"]

Answer 1

It's safe, you won't have any problem using it, the only caution about Hyphens and Shortcodes comes from the Codex.

Take caution when using hyphens in the name of your shortcodes. In the following instance WordPress may see the second opening shortcode as equivalent to the first (basically WordPress sees the first part before the hyphen):

[tag]
[tag-a]

It all depends on which shortcode is defined first. If you are going to use hyphens then define the shortest shortcode first.

To avoid this, use an underscore or simply no separator:

[tag_a]

Answer 2

tl;dr; Dash (hyphen) - is safe to use within shortcode attribute values.

---

Rules for Shortcode attribute values:

For shortcode attribute values, anything other than the following four is usually fine:

1. There shouldn't be any square brackets [ or ], e.g. [foo bar='baa]z']
2. There shouldn't be single quote within single quote, e.g. [foo bar='baa'z']
3. There shouldn't be double quote within double quote, e.g. [foo bar="baa"z"]
4. Back slash \ will be escaped.

---

So the following example shortcode attribute values are just fine:

// dash or hyphen is fine
[foo bar='baa-z']
// Double quote within single quote is fine
[foo bar='baa"z']
// single quote within double quote is fine
[foo bar="baa'z"]
// space is fine
[foo bar='baa z']
// use double back slash to get single back slash 
[foo bar='baa\\z'] 

Quote from codex:

Attribute values must never contain the following characters:

Square braces: [ ]

Quotes: " '

Unquoted values also must never contain spaces.

HTML characters < and > have only limited support in attributes.

The recommended method of escaping special characters in shortcode attributes is HTML encoding. Most importantly, any user input appearing in a shortcode attribute must be escaped or stripped of special characters.

Note that double quotes are allowed inside of single-quoted values and vice versa, however this is not recommended when dealing with user input.

The following characters, if they are not escaped within an attribute value, will be automatically stripped and converted to spaces:

No-break space: \xC2\xA0

Zero-width space: \xE2\x80\x8B