SECURITY: Handle -{}- syntax in attributes safely