Can data-* attribute contain HTML tags?

Question

I.E. <img src="world.jpg" data-title="Hello World!<br/>What gives?"/>

Answer 1

As far as I understand the guidelines, it is basically valid, but it's better to use HTML entities.

From the HTML 4 reference:

You should also escape & within attribute values since entity references are allowed within cdata attribute values. In addition, you should escape > as > to avoid problems with older user agents that incorrectly perceive this as the end of a tag when coming across this character in quoted attribute values.

From the HTML 5 reference:

Except where otherwise specified, attributes on HTML elements may have any string value, including the empty string. Except where explicitly stated, there is no restriction on what text can be specified in such attributes.

So the best thing to do, as @tdammers already says, is to escape these characters (quoting the W3C reference)

• & to represent the & sign.
• < to represent the < sign.
• > to represent the > sign.
• " to represent the " mark.

and decoding them from their entity values if they are to be used as HTML.

Answer 2

Providing you're serving it as text/html, then yes it's valid.

Note that not only is it possible to include markup inside attributes, but the HTML5 srcdoc attribute on the iframe element positively encourages it. The HTML5 draft says:

In the HTML syntax, authors need only remember to use U+0022 QUOTATION MARK characters (") to wrap the attribute contents and then to escape all U+0022 QUOTATION MARK (") and U+0026 AMPERSAND (&) characters, ....

Note, that when served with an XML content type (e.g. application/xhtml+xml), it is not valid, or even well-formed.