It’s simple—you can make it invalid for a JSP to have scripting elements (scriptlets, Java expressions, or declarations) by putting a <scripting-invalid> tag in the DD:
Watch out—you might have seen other books or articles show a page directive that disables scripting. In a draft version of the 2.0 spec, there was a page directive attribute:
<%@ page isScriptingEnabled=”false” %>
This does not work! The isScriptingEnabled attribute is no longer in the JSP spec!
but it was removed from the final spec!!
The only way to invalidate scripting now is through the <scripting-invalid> DD tag.