[BUGFIX] Use callback in preg_replace in RemoveXSS