You get a bonus - 1 coin for daily activity. Now you have 1 coin

Server-side includes (SSI)

Practice



Server Side Includes (SSI) is a simple server-side scripting language used almost exclusively for the Web. As the name suggests, its primary use is to dynamically include the content of one file inside another when the latter is served by a web server.

SSI is mainly used to "insert" the content of one or more files into another. For example, a file (of any type,

.html
,
.txt
etc.) containing a daily quote can be included on several SSI-enabled pages across an entire website by placing the following code on the desired pages:

<! - # include virtual = "../ quote.txt" ->

With a single change to the

quote.txt
file, the pages including the fragment will display the latest daily quotes. Server-side includes are useful for including a shared code fragment across an entire site, such as a navigation menu.

In order for a web server in its default configuration to recognize SSI-enabled HTML files and therefore execute these directives, the file must end with

.shtml
,
.stm
or
.shtm
extension. (It is also possible to configure a web server to process files with the
.html
extension.)

SSI is best suited for simple automation tasks; more complex server-side processing is often performed using one of the more sophisticated programming languages such as Perl, PHP, ASP, JSP, CFML, Python, and Ruby.

Contents

[ hide ]
  • 1 Severity
  • 2 Exploit Likelihood
  • 3 Basic Syntax
  • 4 Directives
    • 4.1 Most Common Directives
    • 4.2 Advanced Directives
  • 5 Client-Side Includes
  • 6 External Links

Severity

High

Exploit Likelihood

Low

Basic Syntax

SSI has a simple syntax:

<!--#directive parameter=value parameter=value -->
. Directives are placed inside HTML comments, so if SSI is not enabled, users will not see SSI directives on the page unless they view its source.

Directives

Most Common Directives

directiveparametersdescriptionexample
include file, direct or virtual This is probably the most widely used SSI directive, allowing the content of one document to be included in another. The file or virtual parameters specify the file (an HTML page, text file, script, etc.) to be included. The file parameter specifies the included file relative to the path of the document; the virtual parameter specifies the included file relative to the document root.
<!--#include virtual="header.html"-->
exec CGI or CMD This directive executes a program, script, or shell command on the server. The cmd parameter specifies a server command; the cgi parameter specifies the path to a CGI script. The PATH_INFO and QUERY_STRING of the current SSI script will be passed to the CGI script. "include virtual" should be used instead of "exec cgi".
<!--#exec cgi="/cgi-bin/foo.cgi"-->

or
<!--#exec cmd="ls -l"-->
echo var This directive displays the content of the specified HTTP environment variable. Variables include HTTP_USER_AGENT, LAST_MODIFIED, and HTTP_ACCEPT.
<!--#echo var="REMOTE_ADDR" -->
config timefmt, sizefmt, or errmsg This directive configures the display formats for date, time, file size, and error message (returned when an SSI command fails).
<!--#config timefmt="%y %m %d" -->

or
<!--#config sizefmt="bytes" -->

or
<!--#config errmsg="SSI command failed!" -->
flastmod or fsize file or virtual These directives display the last modification date of the specified document or the size of the specified document. The file or virtual parameters specify the document to use. The file parameter specifies the document relative to the path of the document; the virtual parameter specifies the document relative to the document root.
<!--#flastmod virtual="index.html"-->

or
<!--#fsize file="script.pl"-->
printenv This directive outputs a list of all variables and their values, including environment variables and user-defined variables. It has no attributes.
<!--#printenv -->

Advanced Directives

directiveparametersdescriptionexample
if expr Used to test conditions that can define and generate several logical pages on a single physical page.
<!--#if expr="${Sec_Nav}" -->

<!--#include virtual="secondary_nav.txt" -->

<!--#endif -->
elif expr Serves the same purpose as further conditional branching in programming languages.
<!--#if expr="${Sec_Nav}" -->

<!--#include virtual="secondary_nav.txt" -->

<!--#elif expr="${Pri_Nav}}">

<!--#include virtual="primary_nav.txt" -->

<!--#endif -->
else If neither the if nor the elif directive matches the current condition, this is where everything should happen.
<!--#if expr="${Sec_Nav}" -->

<!--#include virtual="secondary_nav.txt" -->

<!--#else -->

<!--#include virtual="article.txt" -->

<!--#endif -->
endif Terminates a conditional construct. See above, for example.

Client-Side Includes

Client-side includes are HTML includes achieved on the client side through the use of frames, IFrames, JavaScript, or JavaScript with Ajax requests. These methods suffer from drawbacks not present on the server side: they rely on the client's support for their respective technologies and, in the case of frames and iframes, are less accessible.

created: 2020-07-02
updated: 2026-03-09
269



Was this answer useful?
Choose a quick rating so we can improve the next answer for you.
How satisfied are you?


Comments

To leave a comment

If you have any suggestion, idea, thanks or comment, feel free to write. We really value feedback and are glad to hear your opinion.
To reply

Lectures and tutorial on "information security - Cryptography and Cryptanalysis. Steganography. Information protection"

Terms: information security - Cryptography and Cryptanalysis. Steganography. Information protection