This document demonstrates how to turn on and use Server Side Includes.
Please note that turning on Server Side Includes slows the responsiveness of the affected documents because the server must parse them.
The following example illustrates a simple time display. When included, it will only update when the page is manually refreshed.
What you'll need:
- a text editor, such as Notepad (Windows) or TextEdit (Mac). Important: make sure the editor is set to Plain Text mode and not Rich Text mode.
- an FTP or SFTP client, such as WinSCP (Windows) or Cyberduck (Mac), the same one you used when uploading your website. Note: if you had a third party upload your website, ask them to perform this entire task for you instead.
The server side include
The actual include will look like this:
This text fragment should be placed in your HTML document at the point you want its output inserted. Place the command or script to be executed (in this case showdate.sh, along with full path (in this case /home/jdoe/cgi-bin/), between the quotes.
The short script
The actual script being included is, in this example, called /home/jdoe/cgi-bin/showdate.sh
This runs the date command located locally on the server, which simply outputs the date and time.
The .htaccess file
The options enabled as follows will force Apache to properly execute Server Side Includes.
If you're on one of our newer (version 3) servers, create or edit your .htaccess file to contain the following lines:
Options +Includes AddOutputFilter Includes html
If you're on one of our older servers, use the following lines:
Options +Includes AddType text/x-server-parsed-html .html
Security And Performance Issues
There are a number of security issues involving Server Side Includes which go beyond the scope of this document. Properly used, Server Side Includes can provide powerful flexibility with limited performance impact. Hurricane Electric imposes a few requirements and conditions on the use of Server Side Includes:
Source Available For Inspection
If your server side include executes a compiled program (for example, one written in C) you must keep the source on the server.
Respect For Server Resources
Your server side include must not create performance problems on the server. Simple guidelines for what is reasonable is the load imposed by imagemap or cgiemail.
This example only demonstrates the exec cmd variety of Server Side Include. To find out more, read Apache's HTTPD Server Side Includes document.