The second solution, being selective about how they initially visit a web site, will significantly reduce a user's exposure while still maintaining functionality. Users should understand that they are accepting more risk when they select this option, but are doing so in order to preserve functionality that is important to them. Unfortunately, it is not possible to quantify the risk difference between these two options. Web Users Should Disable Scripting Languages in Their Browsers Exploiting this vulnerability to execute code requires that some form of embedded scripting language be enabled in the victim's browser. The most significant impact of this vulnerability can be avoided by disabling all scripting languages.
Some users are unable or unwilling to disable scripting languages completely.
While disabling these scripting capabilities is the most effective solution, there are some techniques that can be used to reduce a user's exposure to this vulnerability. For this reason, cautious web browsing is not a comparable substitute for disabling scripting. With scripting enabled, visual inspection of links does not protect users from following malicious links, since the attacker's web site may use a script to misrepresent the links in the user's window. For example, the contents of the Goto and Status bars in Netscape are controllable by JavaScript. Solutions for Web Page Developers and Web Site Administrators Web Page Developers Should Recode Dynamically Generated Pages to Validate Output Web site administrators and developers can prevent their sites from being abused in conjunction with this vulnerability by ensuring that dynamically generated pages do not contain undesired tags.