Index: /CKEditor/trunk/CHANGES.html
===================================================================
--- /CKEditor/trunk/CHANGES.html	(revision 6456)
+++ /CKEditor/trunk/CHANGES.html	(revision 6457)
@@ -63,4 +63,5 @@
 		<li><a href="http://dev.ckeditor.com/ticket/6614">#6614</a> : Resize handler in RTL enhancement.</li>
 		<li><a href="http://dev.ckeditor.com/ticket/5924">#5924</a> : Flash plugin now recognizes flash contents without an <code>embed</code> tag.</li>
+		<li><a href="http://dev.ckeditor.com/ticket/4475">#4475</a> : Protected source in attributes and inline CSS text are not handled.</li>
 		<li>Updated the following language files:<ul>
 			<li><a href="http://dev.ckeditor.com/ticket/7124">#7124</a> : Czech;</li>
Index: /CKEditor/trunk/_source/plugins/htmldataprocessor/plugin.js
===================================================================
--- /CKEditor/trunk/_source/plugins/htmldataprocessor/plugin.js	(revision 6456)
+++ /CKEditor/trunk/_source/plugins/htmldataprocessor/plugin.js	(revision 6457)
@@ -253,21 +253,4 @@
 					return CKEDITOR.tools.ltrim( value.replace( /(?:^|\s+)cke_[^\s]*/g, '' ) ) || false;
 				}
-			},
-
-			comment : function( contents )
-			{
-				// If this is a comment for protected source.
-				if ( contents.substr( 0, protectedSourceMarker.length ) == protectedSourceMarker )
-				{
-					// Remove the extra marker for real comments from it.
-					if ( contents.substr( protectedSourceMarker.length, 3 ) == '{C}' )
-						contents = contents.substr( protectedSourceMarker.length + 3 );
-					else
-						contents = contents.substr( protectedSourceMarker.length );
-
-					return new CKEDITOR.htmlParser.cdata( decodeURIComponent( contents ) );
-				}
-
-				return contents;
 			}
 		};
@@ -394,7 +377,22 @@
 	}
 
-	function protectSource( data, protectRegexes )
+	function unprotectSource( html, editor )
+	{
+		var store = editor._.dataStore;
+
+		return html.replace( /<!--\{cke_protected\}([\s\S]+?)-->/g, function( match, data )
+			{
+				return decodeURIComponent( data );
+			}).replace( /\{cke_protected_(\d+)\}/g, function( match, id )
+			{
+				return store && store[ id ] || '';
+			});
+	}
+
+	function protectSource( data, editor )
 	{
 		var protectedHtml = [],
+			protectRegexes = editor.config.protectedSource,
+			store = editor._.dataStore || ( editor._.dataStore = { id : 1 } ),
 			tempRegex = /<\!--\{cke_temp(comment)?\}(\d*?)-->/g;
 
@@ -429,5 +427,8 @@
 						}
 					);
-					return  '<!--{cke_temp}' + ( protectedHtml.push( match ) - 1 ) + '-->';
+
+					// Avoid protecting over protected, e.g. /\{.*?\}/
+					return /cke_temp(comment)?/.test( match ) ? match
+						: '<!--{cke_temp}' + ( protectedHtml.push( match ) - 1 ) + '-->';
 				});
 		}
@@ -440,5 +441,15 @@
 			}
 		);
-		return data;
+
+		// Different protection pattern is used for those that
+		// live in attributes to avoid from being HTML encoded.
+		return data.replace( /(['"]).*?\1/g, function ( match )
+		{
+			return match.replace( /<!--\{cke_protected\}([\s\S]+?)-->/g, function( match, data )
+			{
+				store[ store.id ] = decodeURIComponent( data );
+				return '{cke_protected_'+ store.id++  + '}';
+			})
+		});
 	}
 
@@ -486,5 +497,5 @@
 			// it up and apply the filter.
 
-			data = protectSource( data, this.editor.config.protectedSource );
+			data = protectSource( data, this.editor );
 
 			// Before anything, we must protect the URL attributes as the
@@ -548,5 +559,11 @@
 			fragment.writeHtml( writer, this.htmlFilter );
 
-			return writer.getHtml( true );
+			var data = writer.getHtml( true );
+
+			// Restore those non-HTML protected source. (#4475,#4880)
+			data = unprotectRealComments( data );
+			data = unprotectSource( data, this.editor );
+
+			return data;
 		}
 	};
Index: /CKEditor/trunk/_source/plugins/wysiwygarea/plugin.js
===================================================================
--- /CKEditor/trunk/_source/plugins/wysiwygarea/plugin.js	(revision 6456)
+++ /CKEditor/trunk/_source/plugins/wysiwygarea/plugin.js	(revision 6457)
@@ -903,4 +903,5 @@
 							{
 								isLoadingData = true;
+								editor._.dataStore = { id : 1 };
 
 								var config = editor.config,