Users should understand that they are accepting more risk when they select this option, but are doing so in order to preserve functionality that is important to them. Unfortunately, it is not possible to quantify the risk difference between these two options. Web Users Should Disable Scripting Languages in Their Browsers Exploiting this vulnerability to execute code requires that some form of embedded scripting language be enabled in the victim's browser. The most significant impact of this vulnerability can be avoided by disabling all scripting languages. Malicious use of the tag in particular is not prevented by disabling scripting languages.
Some users are unable or unwilling to disable scripting languages completely.
While disabling these scripting capabilities is the most effective solution, there are some techniques that can be used to reduce a user's exposure to this vulnerability. For this reason, cautious web browsing is not a comparable substitute for disabling scripting. With scripting enabled, visual inspection of links does not protect users from following malicious links, since the attacker's web site may use a script to misrepresent the links in the user's window. For example, the contents of the Goto and Status bars in Netscape are controllable by JavaScript. Attempting to remove dangerous meta-characters from the input stream leaves a number of risks unaddressed.