removing select but keeping DOM XSS