Added modifiable replacement string in xss sanitization, defaults to [removed] if undefined