diff --git a/includes/common.inc b/includes/common.inc
index 34fa9b9..9d9bd39 100644
--- a/includes/common.inc
+++ b/includes/common.inc
@@ -2394,9 +2394,13 @@ function drupal_http_header_attributes(array $attributes = array()) {
  * space-delimited string (for example, a class attribute with multiple values).
  *
  * Attribute values are sanitized by running them through check_plain().
- * Attribute names are not automatically sanitized. When using user-supplied
- * attribute names, it is strongly recommended to allow only white-listed names,
- * since certain attributes carry security risks and can be abused.
+ * Attribute names are not automatically sanitized. No protocol filtering is 
+ * applied, so when using user-entered input as a value for an attribute 
+ * that expects an URI (href, src, ...), drupal_strip_dangerous_protocols() 
+ * should be used to ensure dangerous protocols (such as 'javascript:') are 
+ * removed. When using user-supplied attribute names, it is strongly 
+ * recommended to allow only white-listed names, since certain attributes 
+ * carry security risks and can be abused.
  *
  * Examples of security aspects when using drupal_attributes:
  * @code