I tried that in chrome too, saw it didnt work and presumed the site handled it, not my browser, IE9 avoids it as well, even shows a little popup saying the site has been modified to prevent xss, latest FF still displays the alert though.