Users should understand that they are accepting more risk when they select this option, but are doing so in order to preserve functionality that is important to them. Unfortunately, it is not possible to quantify the risk difference between these two options. Exploiting this vulnerability to execute code requires that some form of embedded scripting language be enabled in the victim's browser. The most significant impact of this vulnerability can be avoided by disabling all scripting languages. Malicious use of the tag in particular is not prevented by disabling scripting languages.
Some users are unable or unwilling to disable scripting languages completely.
While disabling these scripting capabilities is the most effective solution, there are some techniques that can be used to reduce a user's exposure to this vulnerability. For this reason, cautious web browsing is not a comparable substitute for disabling scripting. With scripting enabled, visual inspection of links does not protect users from following malicious links, since the attackers web site may use a script to misrepresent the links in users window. For example, the contents of the Goto and Status bars in Netscape are controllable by JavaScript. Solutions for Web Page Developers and Web Site Administrators Web Page Developers Should Recode Dynamically Generated Pages to Validate Output.