@@ -88,6 +88,15 @@ call. *[mapext]* is substituted by a space delimited set of lower left
 and upper right coordinates. This would break the URL. *[mapext_esc]*
 is substituted by a proper encoded set.
 
+.. warning::
+
+    If the datasource is untrusted, use the escaped versions of template
+    substitutions to avoid cross-site scripting (XSS) vulnerabilities.
+
+    For example, if a field contains ``<script>alert(1)</script>`` and the
+    unescaped value is included in the generated HTML, the script could be
+    executed in the user's browser.
+
 Format
 ======
 
@@ -772,6 +781,10 @@ processed as a result of a query.
 
         [item name="area" precision="2" commify="2" format="Area is $value"]
 
+[values]
+     All attribute values of the feature in a single comma-delimited string.
+     The values are unescaped. Available only when processing query results.
+
 [attribute name],[attrribute name_esc],[attribute item name_raw]
      Attribute name from the data table of a queried layer. Only
      attributes for the active query layers are accessible. Case must