diff --git a/includes/common.inc b/includes/common.inc
index 705f2e6..532a642 100644
--- a/includes/common.inc
+++ b/includes/common.inc
@@ -1776,10 +1776,9 @@ function format_rss_item($title, $link, $description, $args = array()) {
  * with the same format as $array itself for nesting.
  *
  * If 'encoded' is TRUE it is up to the caller to ensure that 'value' is either
- * entity-encoded or CDATA-escaped.
- *
- * Only use this option if you have already escaped the data as not doing so
- * has security implications.
+ * entity-encoded or CDATA-escaped. Using this option is not recommended when
+ * working with untrusted user input, since failing to escape the data
+ * correctly has security implications.
  */
 function format_xml_elements($array) {
   $output = '';