As per usual, there are solutions for all challenges
Can you get the page to calculate 7*7 and output 49 all on it's own?
Can you also get a pop-up? This will require you to escape the sandbox.

XSS Lab Application

The code here uses urldecode(str_replace("{", "", ...)), which is intended to be safe against XSS. However, there's a way to trigger a popup using a carefully crafted payload. Can you figure it out? Remember, we replace {.

Vulnerable Input

The following block displays the input parameter after processing:

Additional Parameters

This lab also includes other parameters to explore: