## Why is this an issue?

JSP expressions (using `<%= ... %>`) have been deprecated because they:

- Are not unit testable.
- Are not reusable.
- Cannot make use of object oriented concepts such as inheritence.
- Have poor error handling capabilities: if an exception is thrown, an empty page is rended.
- Mix the business and presentation logic.

JSP Standard Tag Library (JSTL) and Expression Language should be used instead, enabiling the adoption of the model-view-controller (MVC) design pattern which reduces the coupling between the presentation tier and the business logic.

### Noncompliant code example

    <input type="text" name="foo" value="<%= request.getParameter("foo") %>" />

### Compliant solution

    <input type="text" name="foo" value="${fn:escapeXml(param.foo)}" />