It’s simple—you can make it invalid for a JSP to have scripting elements (scriptlets, Java expressions, or declarations) by putting a <scripting-invalid> tag in the DD:
Watch out—you might have seen other books or articles show a page directive that disables scripting. In a draft version of the 2.0 spec, there was a page directive attribute:
<%@ page isScriptingEnabled=”false” %>
but it was removed from the final spec!!
The only way to invalidate scripting now is through the <scripting-invalid> DD tag.