[lazyjones]

' after the timer value, then proceed to construct a JS expression that will be evaluated before the call to setTimer ... Hint: '99'+moo() will evaluate nicely. Don't forgot the "open" the ' again.

[rhubarbcustard]

I can't figure how to close the quote after the '99 ? I realise that specifying ' on URL gets encoded to %27 but not sure how to turn that into the closing ' for startTime('99'); .....

Help!

[aetch]

Can you elaborate on this? I tried that and got "unexpected identifier" as a console error. Not sure how it works.

[tautvidas]

The point is to break out of the startTimer() function call, e.g.:

    startTimer('');foo();//');

The remaining '); can be commented out in order to not create any syntax errors.

[lazyjones]

SPOILER ALERT

I used this: 1'* alert()* '

(without the spaces needed for markdown here)

[rhubarbcustard]

Could you explain why the * works in there?

[lazyjones]

JS does automatic type conversion in this case, so it's syntactically correct to multiply a string with a number (or function result). We're just interested in the side-effects of alert(), so it doesn't really matter what kind of expression we use it in, as long as it parses correctly and causes alert() to be executed (evaluated).

[mariocarvalho]

Nice!

[namanaggarwal]

still not able to get :-(

[sourthyme]

Use the text input instead of the url.

[erid]

You could use %2b instead of + on the URL and it'll work, or just * as mentioned above.

[voxtex]

' + alert() + '

worked for me.

[codeman123]

can't solve it either :-/