This module provides a filter which will process files before they are sent to the client. The processing is controlled by specially formatted SGML comments, referred to as elements. These elements allow conditional text, the inclusion of other files or programs, as well as the setting and printing of environment variables.
Server Side Includes are implemented by the
INCLUDES filter. If
documents containing server-side include directives are given
the extension .shtml, the following directives will make Apache
parse them and assign the resulting document the mime type of
text/html:
The following directive must be given for the directories
containing the shtml files (typically in a
.htaccess files if
Options
is set):
For backwards compatibility, the server-parsed
handler also activates the
INCLUDES filter. As well, Apache will activate the INCLUDES
filter for any document with mime type
text/x-server-parsed-html or
text/x-server-parsed-html3 (and the resulting
output will have the mime type text/html).
For more information, see our Tutorial on Server Side Includes.
Files processed for server-side includes no longer accept
requests with PATH_INFO (trailing pathname information)
by default. You can use the PATH_INFO.
The document is parsed as an HTML document, with special commands embedded as SGML comments. A command has the syntax:
The value will often be enclosed in double quotes, but single
quotes (') and backticks (`) are also
possible. Many commands only allow a single attribute-value pair.
Note that the comment terminator (-->) should be
preceded by whitespace to ensure that it isn't considered part of
an SSI token. Note that the leading <!--# is one
token and may not contain any whitespaces.
The allowed elements are listed in the following table:
| Element | Description |
|---|---|
comment |
SSI comment |
config |
configure output formats |
echo |
print variables |
exec |
execute external programs |
fsize |
print size of a file |
flastmod |
print last modification time of a file |
include |
include a file |
printenv |
print all available variables |
set |
set a value of a variable |
SSI elements may be defined by modules other than
exec element is provided by
This command doesn't output anything. Its only use is to add comments within a file. These comments are not printed.
This syntax is available in version 2.4.21 and later.
This command controls various aspects of the parsing. The valid attributes are:
echomsg (Apache 2.1 and later)The value is a message that is sent back to the
client if the echo element
attempts to echo an undefined variable. This overrides any
errmsgThe value is a message that is sent back to the
client if an error occurs while parsing the
document. This overrides any
sizefmtThe value sets the format to be used when displaying
the size of a file. Valid values are bytes
for a count in bytes, or abbrev for a count
in Kb or Mb as appropriate, for example a size of 1024 bytes
will be printed as "1K".
timefmtThe value is a string to be used by the
strftime(3) library routine when printing
dates.
This command prints one of the include
variables defined below. If the variable is unset, the result is
determined by the timefmt.
Attributes:
vardecodingSpecifies whether Apache should strip an encoding from
the variable before processing the variable further. The default
is none, where no decoding will be done. If set to
url, then URL decoding (also known as %-encoding;
this is appropriate for use within URLs in links, etc.) will be
performed. If set to urlencoded,
application/x-www-form-urlencoded compatible encoding (found in
query strings) will be stripped. If set to base64,
base64 will be decoded, and if set to entity, HTML
entity encoding will be stripped. Decoding is done prior to any
further encoding on the variable. Multiple encodings can be
stripped by specifying more than one comma separated encoding.
The decoding setting will remain in effect until the next decoding
attribute is encountered, or the element ends.
The decoding attribute must precede the
corresponding var attribute to be effective.
encodingSpecifies how Apache should encode special characters
contained in the variable before outputting them. If set
to none, no encoding will be done. If set to
url, then URL encoding (also known as %-encoding;
this is appropriate for use within URLs in links, etc.) will be
performed. If set to urlencoded,
application/x-www-form-urlencoded compatible encoding will be
performed instead, and should be used with query strings. If set
to base64, base64 encoding will be performed. At
the start of an echo element, the default is set to
entity, resulting in entity encoding (which is
appropriate in the context of a block-level HTML element,
e.g. a paragraph of text). This can be changed by adding
an encoding attribute, which will remain in effect
until the next encoding attribute is encountered or
the element ends, whichever comes first.
The encoding attribute must precede the
corresponding var attribute to be effective.
The exec command executes a given shell command or
CGI script. It requires IncludesNOEXEC is set, this command is completely
disabled. The valid attributes are:
cgiThe value specifies a (%-encoded) URL-path to
the CGI script. If the path does not begin with a slash (/),
then it is taken to be relative to the current
document. The document referenced by this path is
invoked as a CGI script, even if the server would not
normally recognize it as such. However, the directory
containing the script must be enabled for CGI scripts
(with ExecCGI).
The CGI script is given the PATH_INFO and query
string (QUERY_STRING) of the original request from the
client; these cannot be specified in the URL path. The
include variables will be available to the script in addition to
the standard CGI environment.
If the script returns a Location: header instead of
output, then this will be translated into an HTML anchor.
The include virtual
element should be used in preference to exec cgi. In
particular, if you need to pass additional arguments to a CGI program,
using the query string, this cannot be done with exec
cgi, but can be done with include virtual, as
shown here:
cmdThe server will execute the given string using
/bin/sh. The include variables are available to the command, in addition
to the usual set of CGI variables.
The use of #include virtual is almost always preferred to using
either #exec cgi or #exec cmd. The former
(#include virtual) uses the standard Apache sub-request
mechanism to include files or scripts. It is much better tested and
maintained.
In addition, on some platforms, like Win32, and on unix when
using suexec, you cannot pass arguments
to a command in an exec directive, or otherwise include
spaces in the command. Thus, while the following will work under a
non-suexec configuration on unix, it will not produce the desired
result under Win32, or when running suexec:
This command prints the size of the specified file, subject
to the sizefmt format specification. Attributes:
filefile cannot start with a slash
(/), nor can it contain ../ so as to
refer to a file above the current directory or outside of the
document root. Attempting to so will result in the error message:
The given path was above the root path.
virtualNote that in many cases these two are exactly the same thing.
However, the file attribute doesn't respect URL-space
aliases.
This command prints the last modification date of the
specified file, subject to the timefmt format
specification. The attributes are the same as for the
fsize command.
This command inserts the text of another document or file
into the parsed file. Any included file is subject to the usual
access control. If the directory containing the parsed file has
Options
IncludesNOEXEC set, then only documents with a text
text/plain,
text/html etc.) will be included. Otherwise CGI
scripts are invoked as normal using the complete URL given in
the command, including any query string.
An attribute defines the location of the document, and may appear more than once in an include element; an inclusion is done for each attribute given to the include command in turn. The valid attributes are:
file../, nor can it be an absolute path.
Therefore, you cannot include files that are outside of the
document root, or above the current document in the directory
structure. The virtual attribute should always be
used in preference to this one.virtualThe value is a (%-encoded) URL-path. The URL cannot contain a scheme or hostname, only a path and an optional query string. If it does not begin with a slash (/) then it is taken to be relative to the current document.
A URL is constructed from the attribute, and the output the server would return if the URL were accessed by the client is included in the parsed output. Thus included files can be nested.
If the specified URL is a CGI program, the program will be executed and its output inserted in place of the directive in the parsed file. You may include a query string in a CGI url:
include virtual should be used in preference
to exec cgi to include the output of CGI programs
into an HTML document.
If the
onerrorThe value is a (%-encoded) URL-path which is shown should a previous attempt to include a file or virtual attribute failed. To be effective, this attribute must be specified after the file or virtual attributes being covered. If the attempt to include the onerror path fails, or if onerror is not specified, the default error message will be included.
This prints out a plain text listing of all existing variables and
their values. Special characters are entity encoded (see the echo element for details)
before being output. There are no attributes.
This sets the value of a variable. Attributes:
varvaluedecodingSpecifies whether Apache should strip an encoding from
the variable before processing the variable further. The default
is none, where no decoding will be done. If set to
url, urlencoded, base64
or entity, URL decoding,
application/x-www-form-urlencoded decoding, base64 decoding or HTML
entity decoding will be performed respectively. More than one
decoding can be specified by separating with commas. The decoding
setting will remain in effect until the next decoding attribute
is encountered, or the element ends. The decoding
attribute must precede the corresponding
var attribute to be effective.
encodingSpecifies how Apache should encode special characters
contained in the variable before setting them. The default is
none, where no encoding will be done. If set to
url, urlencoding, base64
or entity, URL encoding,
application/x-www-form-urlencoded encoding, base64 encoding or
HTML entity encoding will be performed respectively. More than
one encoding can be specified by separating with commas. The
encoding setting will remain in effect until the next encoding
attribute is encountered, or the element ends. The
encoding attribute must precede the
corresponding var attribute to be effective.
Encodings are applied after all decodings have been
stripped.
In addition to the variables in the standard CGI environment,
these are available for the echo command, for
if and elif, and to any program
invoked by the document.
DATE_GMTDATE_LOCALDOCUMENT_ARGSinclude SSI directive, QUERY_STRING
will represent the query string of the subrequest and
DOCUMENT_ARGS will represent the query string of
the SSI document. (Available in Apache HTTP Server 2.4.19 and
later.)DOCUMENT_NAMEDOCUMENT_PATH_INFOPATH_INFO.DOCUMENT_URILAST_MODIFIEDQUERY_STRING_UNESCAPED& etc. are preceded by
backslashes). It is not set if a query string is not
present. Use DOCUMENT_ARGS if shell escaping
is not desired.USER_NAMEVariable substitution is done within quoted strings in most
cases where they may reasonably occur as an argument to an SSI
directive. This includes the config,
exec, flastmod, fsize,
include, echo, and set
directives. If on,
substitution also occurs in the arguments to conditional operators.
You can insert a literal dollar sign into the string using backslash
quoting:
If a variable reference needs to be substituted in the middle of a character sequence that might otherwise be considered a valid identifier in its own right, it can be disambiguated by enclosing the reference in braces, a la shell substitution:
This will result in the Zed variable being set
to "X_Y" if REMOTE_HOST is
"X" and REQUEST_METHOD is
"Y".
The basic flow control elements are:
The if element works like an if statement in a
programming language. The test condition is evaluated and if
the result is true, then the text until the next elif,
else or endif element is included in the
output stream.
The elif or else statements are used
to put text into the output stream if the original
test_condition was false. These elements are optional.
The endif element ends the if element
and is required.
test_condition is a boolean expression which follows the
ap_expr syntax. The syntax can be changed
to be compatible with Apache HTTPD 2.2.x using
The SSI variables set with the var element are exported
into the request environment and can be accessed with the
reqenv function. As a short-cut, the function name
v is also available inside
The below example will print "from local net" if client IP address belongs to the 10.0.0.0/8 subnet.
The below example will print "foo is bar" if the variable
foo is set to the value "bar".
See also: Expressions in Apache HTTP Server,
for a complete reference and examples. The restricted functions
are not available inside
This section describes the syntax of the #if expr
element if on.
string-A stringtrue if the URL represented by the string is accessible by configuration, false otherwise. This is useful where content on a page is to be hidden from users who are not authorized to view the URL, such as a link to that URL. Note that the URL is only tested for whether access would be granted, not whether the URL exists.
string1 = string2
string1 == string2
string1 != string2Compare string1 with string2. If
string2 has the form /string2/
then it is treated as a regular expression. Regular expressions are
implemented by the PCRE engine and
have the same syntax as those in perl
5. Note that == is just an alias for =
and behaves exactly the same way.
If you are matching positive (= or ==), you
can capture grouped parts of the regular expression. The captured parts
are stored in the special variables $1 ..
$9. The whole string matched by the regular expression is
stored in the special variable $0
string1 < string2
string1 <= string2
string1 > string2
string1 >= string2strcmp(3)). Therefore the string "100" is less than
"20".( test_condition )! test_conditiontest_condition1 &&
test_condition2test_condition1 ||
test_condition2"=" and "!=" bind more tightly than
"&&" and "||". "!" binds
most tightly. Thus, the following are equivalent:
The boolean operators && and ||
share the same priority. So if you want to bind such an operator more
tightly, you should use parentheses.
Anything that's not recognized as a variable or an operator
is treated as a string. Strings can also be quoted:
'string'. Unquoted strings can't contain whitespace
(blanks and tabs) because it is used to separate tokens such as
variables. If multiple strings are found in a row, they are
concatenated using blanks. So,
string1 string2 results in string1 string2
and
'string1 string2' results in string1 string2.
If the expressions become more complex and slow down processing significantly, you can try to optimize them according to the evaluation rules:
&& and ||)
are short circuited wherever possible. In conclusion with the rule
above that means, $1 .. $9).If you want to look how a particular expression is handled, you can
recompile -DDEBUG_INCLUDE compiler option. This inserts for every
parsed expression tokenizer information, the parse tree and how it is
evaluated into the output sent to the client.
All slashes which are not intended to act as delimiters in your regex must be escaped. This is regardless of their meaning to the regex engine.
This directive changes the string that
This directive changes the string that
The "<!-- Error -->" so that
the message is not presented to the user.
This directive has the same effect as the <!--#config
errmsg=message --> element.
This directive changes the string that
You may want to use this option if you have 2 servers parsing the output of a file each processing different commands (possibly at different times).
The example given above, which also specifies a matching
This directive changes the format in which date strings are displayed
when echoing DATE environment variables. The
formatstring is as in strftime(3) from the
C standard library.
This directive has the same effect as the <!--#config
timefmt=formatstring --> element.
The above directive would cause times to be displayed in the format "22:26, June 14, 2002".
Under normal circumstances, a file filtered by ETag header for the
response by adding no-etag to the request notes.
The ETag header.
This can be used to enable caching of the output. Note that a backend server
or dynamic content generator may generate an ETag of its own, ignoring
no-etag, and this ETag will be passed by
offno-etag will be added to the request notes, and the server
is asked not to generate an ETag. Where a server ignores the value of
no-etag and generates an ETag anyway, the ETag will be
respected.onLast-Modified headers are generated by the
server.Under normal circumstances, a file filtered by Last-Modified header is stripped from the response.
The Last-Modified header to be respected
if already present, or set if the header is not already present. This can
be used to enable caching of the output.
offLast-Modified header will be stripped from responses,
unless the full as described below.onLast-Modified header will be respected if already
present in a response, and added to the response if the response is a
file and the header is missing. The
As of version 2.3.13, #if flow control elements. This directive allows to
switch to the old syntax which is compatible
with Apache HTTPD version 2.2.x and earlier.
The text/html.
offontext/html file that has the user-execute bit
set will be treated as a server-parsed html document.fullon but also test the group-execute bit.
If it is set, then set the Last-modified date of the
returned file to be the last modified time of the file. If
it is not set, then no last-modified date is sent. Setting
this bit allows clients and proxies to cache the result of
the request.
You would not want to use the full option, unless you assure the
group-execute bit is unset for every SSI script which might #include a CGI or otherwise produces different output on
each hit (or could potentially change on subsequent requests).
The on.