So why don't we just make the same setting. An option to turn them off.

<script type="text/javascript">alert("remember when scripting attacks worked?");</script>