I recently read how to disable scripting for an entire application by adding the following elements to the web.xml file:
It disables scriptlets, which is basically java code in the JSP e.g.
<% request.getAttribute("bob"); %>
would not be allowed.
JSTL, EL, etc. will all work fine.