level 4

In timer.html, we observe:

<img src="/static/loading.gif" onload="startTimer('{{ timer }}');" />

where {{ timer }} is the value submitted

Submit:

1');alert('1