What are the effects of disabling scripting in a JSP?

Question

I recently read how to disable scripting for an entire application by adding the following elements to the web.xml file:

Answer 1

It disables scriptlets, which is basically java code in the JSP e.g.

<% request.getAttribute("bob"); %>

would not be allowed.

JSTL, EL, etc. will all work fine.

Answer 2

It disables scriptlets (<% %>), scriptlet expressions (<%= %>) and scriptlet declarations (<%! %>), which is a way of embedding raw Java code inside a JSP file. Using scriptlets has indeed been discouraged since the birth of taglibs/EL in favor of better readable and maintainable code.

See also:

• Java EE 5 tutorial - disabling scripting