Only match evil HTML attributes on word boundaries