As long as you're not injecting unvalidated request parameters in your JSPs, you will be fine.