Does it have something to do with the GBK character set vulnerability discussed in class?
No, that’s not it. I think I figured it out, but when I call alert to test my attack, nothing happens. It turns out that calling alert would lead to an infinite loop of dialog boxes, so Firefox is trying to be helpful by preventing it. Try using something like document.loginform.login_username.value=42 to test whether your attack is working.
