I'm fairly certain this get's run through the query tokenizer, so you don't want to do it that way if you want this to be secure.  instead use ```{!raw f=field v=@collection.id}```. @cbeer @ndushay can you verify that I'm not lying?