diff --git a/includes/common.inc b/includes/common.inc
index c4689f5..ef76dda 100644
--- a/includes/common.inc
+++ b/includes/common.inc
@@ -1597,8 +1597,8 @@ function _filter_xss_attributes($attr) {
           // attributes performing this filtering causes valid and safe data
           // to be mangled. We prevent this by skipping protocol filtering on
           // such attributes.
-          // @see filter_xss_bad_protocol()
-          // @see http://www.w3.org/TR/html4/index/attributes.html
+          // See filter_xss_bad_protocol() and
+          // http://www.w3.org/TR/html4/index/attributes.html.
           $skip_protocol_filtering = substr($attrname, 0, 5) === 'data-' || in_array($attrname, array(
             'title',
             'alt',
@@ -1718,6 +1718,11 @@ function filter_xss_bad_protocol($string, $decode = TRUE) {
 /**
  * Applies a very permissive XSS/HTML filter to data-attributes.
  *
+ * Contrib modules which allow rich text fields to be edited using client-side
+ * WYSIWYG editors must apply XSS filtering to the contents of data-attributes
+ * since they can contain encoded HTML markup that could be decoded and
+ * interpreted by editors.
+ *
  * @param string $html
  *   The string to apply the data-attributes filtering to.
  *
@@ -1727,7 +1732,7 @@ function filter_xss_bad_protocol($string, $decode = TRUE) {
 function filter_xss_data_attributes($html) {
   if (stristr($html, 'data-') !== FALSE) {
     $dom = filter_dom_load($html);
-    $xpath = new \DOMXPath($dom);
+    $xpath = new DOMXPath($dom);
     foreach ($xpath->query('//@*[starts-with(name(.), "data-")]') as $node) {
       // The data-attributes contain an HTML-encoded value, so we need to
       // decode the value, apply XSS filtering and then re-save as encoded