Rename alert('xss'); to <script>alert(1)