I think these have been broken since the query parser update. Basically the inner node for the string content was preventing injections because include-children was not set.
