Do not assume that the value provided to attributeValueFilter() is properly escaped if the value is a URI.