Apache Module mod_include

Summary

This module provides a filter which will process files before they are sent to the client. The processing is controlled by specially formatted SGML comments, referred to aselements. These elements allow conditional text, the inclusion of other files or programs, as well as the setting and printing of environment variables.

Topics

• Enabling Server-Side Includes
• PATH_INFO with Server Side Includes
• Available Elements
• Include Variables
• Variable Substitution
• Flow Control Elements
• Legacy expression syntax

Directives

• SSIEndTag
• SSIErrorMsg
• SSIETag
• SSILastModified
• SSILegacyExprParser
• SSIStartTag
• SSITimeFormat
• SSIUndefinedEcho
• XBitHack

Bugfix checklist

• httpd changelog
• Known issues
• Report a bug

See also

• Options
• AcceptPathInfo
• Filters
• SSI Tutorial
• Comments

Enabling Server-Side Includes

Server Side Includes are implemented by theINCLUDESfilter. If documents containing server-side include directives are given the extension .shtml, the following directives will make Apache parse them and assign the resulting document the mime type oftext/html:

AddType text/html .shtmlAddOutputFilter INCLUDES .shtml

The following directive must be given for the directories containing the shtml files (typically in a<Directory> section, but this directive is also valid in.htaccess files ifAllowOverrideOptions is set):

Options +Includes

For backwards compatibility, theserver-parsedhandler also activates the INCLUDES filter. As well, Apache will activate the INCLUDES filter for any document with mime typetext/x-server-parsed-html ortext/x-server-parsed-html3 (and the resulting output will have the mime typetext/html).

For more information, see ourTutorial on Server Side Includes.

PATH_INFO with Server Side Includes

Files processed for server-side includes no longer accept requests withPATH_INFO (trailing pathname information) by default. You can use theAcceptPathInfo directive to configure the server to accept requests withPATH_INFO.

Available Elements

The document is parsed as an HTML document, with special commands embedded as SGML comments. A command has the syntax:

The value will often be enclosed in double quotes, but single quotes (') and backticks (`) are also possible. Many commands only allow a single attribute-value pair. Note that the comment terminator (-->) should be preceded by whitespace to ensure that it isn't considered part of an SSI token. Note that the leading<!--# isone token and may not contain any whitespaces.

The allowed elements are listed in the following table:

SSI elements may be defined by modules other thanmod_include. In fact, theexec element is provided bymod_cgi, and will only be available if this module is loaded.

The comment Element

This command doesn't output anything. Its only use is to add comments within a file. These comments are not printed.

This syntax is available in version 2.4.21 and later.

The config Element

This command controls various aspects of the parsing. The valid attributes are:

echomsg (Apache 2.1 and later)

The value is a message that is sent back to the client if theecho element attempts to echo an undefined variable. This overrides anySSIUndefinedEcho directives.

<!--#config echomsg="[Value Undefined]" -->

errmsg

The value is a message that is sent back to the client if an error occurs while parsing the document. This overrides anySSIErrorMsg directives.

<!--#config errmsg="[Oops, something broke.]" -->

sizefmt

The value sets the format to be used when displaying the size of a file. Valid values arebytes for a count in bytes, orabbrev for a count in Kb or Mb as appropriate, for example a size of 1024 bytes will be printed as "1K".

<!--#config sizefmt="abbrev" -->

timefmt

The value is a string to be used by thestrftime(3) library routine when printing dates.

<!--#config timefmt=""%R, %B %d, %Y"" -->

The echo Element

This command prints one of theinclude variables defined below. If the variable is unset, the result is determined by theSSIUndefinedEcho directive. Any dates printed are subject to the currently configuredtimefmt.

Attributes:

var

The value is the name of the variable to print.

decoding

Specifies whether Apache should strip an encoding from the variable before processing the variable further. The default isnone, where no decoding will be done. If set tourl, then URL decoding (also known as %-encoding; this is appropriate for use within URLs in links, etc.) will be performed. If set tourlencoded, application/x-www-form-urlencoded compatible encoding (found in query strings) will be stripped. If set tobase64, base64 will be decoded, and if set toentity, HTML entity encoding will be stripped. Decoding is done prior to any further encoding on the variable. Multiple encodings can be stripped by specifying more than one comma separated encoding. The decoding setting will remain in effect until the next decoding attribute is encountered, or the element ends.

Thedecoding attribute mustprecede the correspondingvar attribute to be effective.

encoding

Specifies how Apache should encode special characters contained in the variable before outputting them. If set tonone, no encoding will be done. If set tourl, then URL encoding (also known as %-encoding; this is appropriate for use within URLs in links, etc.) will be performed. If set tourlencoded, application/x-www-form-urlencoded compatible encoding will be performed instead, and should be used with query strings. If set tobase64, base64 encoding will be performed. At the start of anecho element, the default is set toentity, resulting in entity encoding (which is appropriate in the context of a block-level HTML element,e.g. a paragraph of text). This can be changed by adding anencoding attribute, which will remain in effect until the nextencoding attribute is encountered or the element ends, whichever comes first.

Theencoding attribute mustprecede the correspondingvar attribute to be effective.

In order to avoid cross-site scripting issues, you shouldalways encode user supplied data.

Example

<!--#echo encoding="entity" var="QUERY_STRING" -->

The exec Element

Theexec command executes a given shell command or CGI script. It requiresmod_cgi to be present in the server. IfOptionsIncludesNOEXEC is set, this command is completely disabled. The valid attributes are:

cgi

The value specifies a (%-encoded) URL-path to the CGI script. If the path does not begin with a slash (/), then it is taken to be relative to the current document. The document referenced by this path is invoked as a CGI script, even if the server would not normally recognize it as such. However, the directory containing the script must be enabled for CGI scripts (withScriptAlias orOptionsExecCGI).

The CGI script is given thePATH_INFO and query string (QUERY_STRING) of the original request from the client; thesecannot be specified in the URL path. The include variables will be available to the script in addition to the standardCGI environment.

Example

<!--#exec cgi="/cgi-bin/example.cgi" -->

If the script returns aLocation: header instead of output, then this will be translated into an HTML anchor.

Theinclude virtual element should be used in preference toexec cgi. In particular, if you need to pass additional arguments to a CGI program, using the query string, this cannot be done withexec cgi, but can be done withinclude virtual, as shown here:

<!--#include virtual="/cgi-bin/example.cgi?argument=value" -->

cmd

The server will execute the given string using/bin/sh. Theinclude variables are available to the command, in addition to the usual set of CGI variables.

The use of#include virtual is almost always preferred to using either#exec cgi or#exec cmd. The former (#include virtual) uses the standard Apache sub-request mechanism to include files or scripts. It is much better tested and maintained.

In addition, on some platforms, like Win32, and on unix when usingsuexec, you cannot pass arguments to a command in anexec directive, or otherwise include spaces in the command. Thus, while the following will work under a non-suexec configuration on unix, it will not produce the desired result under Win32, or when running suexec:

<!--#exec cmd="perl /path/to/perlscript arg1 arg2" -->

The fsize Element

This command prints the size of the specified file, subject to thesizefmt format specification. Attributes:

file

The value is a path relative to the directory containing the current document being parsed.

This file is <!--#fsize file="mod_include.html" --> bytes.

The value offile cannot start with a slash (/), nor can it contain../ so as to refer to a file above the current directory or outside of the document root. Attempting to so will result in the error message:The given path was above the root path.

virtual

The value is a (%-encoded) URL-path. If it does not begin with a slash (/) then it is taken to be relative to the current document. Note, that this doesnot print the size of any CGI output, but the size of the CGI script itself.

Note that in many cases these two are exactly the same thing. However, thefile attribute doesn't respect URL-space aliases.

The flastmod Element

This command prints the last modification date of the specified file, subject to thetimefmt format specification. The attributes are the same as for thefsize command.

The include Element

This command inserts the text of another document or file into the parsed file. Any included file is subject to the usual access control. If the directory containing the parsed file hasOptionsIncludesNOEXEC set, then only documents with a textMIME-type (text/plain,text/html etc.) will be included. Otherwise CGI scripts are invoked as normal using the complete URL given in the command, including any query string.

An attribute defines the location of the document, and may appear more than once in an include element; an inclusion is done for each attribute given to the include command in turn. The valid attributes are:

file

The value is a path relative to the directory containing the current document being parsed. It cannot contain../, nor can it be an absolute path. Therefore, you cannot include files that are outside of the document root, or above the current document in the directory structure. Thevirtual attribute should always be used in preference to this one.

virtual

The value is a (%-encoded) URL-path. The URL cannot contain a scheme or hostname, only a path and an optional query string. If it does not begin with a slash (/) then it is taken to be relative to the current document.

A URL is constructed from the attribute, and the output the server would return if the URL were accessed by the client is included in the parsed output. Thus included files can be nested.

If the specified URL is a CGI program, the program will be executed and its output inserted in place of the directive in the parsed file. You may include a query string in a CGI url:

<!--#include virtual="/cgi-bin/example.cgi?argument=value" -->

include virtual should be used in preference toexec cgi to include the output of CGI programs into an HTML document.

If theKeptBodySize directive is correctly configured and valid for this included file, attempts to POST requests to the enclosing HTML document will be passed through to subrequests as POST requests as well. Without the directive, all subrequests are processed as GET requests.

onerror

The value is a (%-encoded) URL-path which is shown should a previous attempt to include a file or virtual attribute failed. To be effective, this attribute must be specified after the file or virtual attributes being covered. If the attempt to include the onerror path fails, or if onerror is not specified, the default error message will be included.

# Simple example
<!--#include virtual="/not-exist.html" onerror="/error.html" -->

# Dedicated onerror paths
<!--#include virtual="/path-a.html" onerror="/error-a.html" virtual="/path-b.html" onerror="/error-b.html" -->

The printenv Element

This prints out a plain text listing of all existing variables and their values. Special characters are entity encoded (see theecho element for details) before being output. There are no attributes.

The set Element

This sets the value of a variable. Attributes:

var

The name of the variable to set.

value

The value to give a variable.

decoding

Specifies whether Apache should strip an encoding from the variable before processing the variable further. The default isnone, where no decoding will be done. If set tourl,urlencoded,base64 orentity, URL decoding, application/x-www-form-urlencoded decoding, base64 decoding or HTML entity decoding will be performed respectively. More than one decoding can be specified by separating with commas. The decoding setting will remain in effect until the next decoding attribute is encountered, or the element ends. Thedecoding attribute mustprecede the correspondingvar attribute to be effective.

encoding

Specifies how Apache should encode special characters contained in the variable before setting them. The default isnone, where no encoding will be done. If set tourl,urlencoding,base64 orentity, URL encoding, application/x-www-form-urlencoded encoding, base64 encoding or HTML entity encoding will be performed respectively. More than one encoding can be specified by separating with commas. The encoding setting will remain in effect until the next encoding attribute is encountered, or the element ends. Theencoding attribute mustprecede the correspondingvar attribute to be effective. Encodings are applied after all decodings have been stripped.

Include Variables

In addition to the variables in the standard CGI environment, these are available for theecho command, forif andelif, and to any program invoked by the document.

DATE_GMT

The current date in Greenwich Mean Time.

DATE_LOCAL

The current date in the local time zone.

DOCUMENT_ARGS

This variable contains the query string of the active SSI document, or the empty string if a query string is not included. For subrequests invoked through theinclude SSI directive,QUERY_STRING will represent the query string of the subrequest andDOCUMENT_ARGS will represent the query string of the SSI document. (Available in Apache HTTP Server 2.4.19 and later.)

DOCUMENT_NAME

The filename (excluding directories) of the document requested by the user.

DOCUMENT_PATH_INFO

The trailing pathname information. See directiveAcceptPathInfo for more information aboutPATH_INFO.

DOCUMENT_URI

The (%-decoded) URL path of the document requested by the user. Note that in the case of nested include files, this isnot the URL for the current document. Note also that if the URL is modified internally (e.g. by analias ordirectoryindex), the modified URL is shown.

LAST_MODIFIED

The last modification date of the document requested by the user.

QUERY_STRING_UNESCAPED

If a query string is present in the request for the active SSI document, this variable contains the (%-decoded) query string, which isescaped for shell usage (special characters like& etc. are preceded by backslashes). It is not set if a query string is not present. UseDOCUMENT_ARGS if shell escaping is not desired.

USER_NAME

The user name of the owner of the file.

Variable Substitution

Variable substitution is done within quoted strings in most cases where they may reasonably occur as an argument to an SSI directive. This includes theconfig,exec,flastmod,fsize,include,echo, andset directives. IfSSILegacyExprParser is set toon, substitution also occurs in the arguments to conditional operators. You can insert a literal dollar sign into the string using backslash quoting:

If a variable reference needs to be substituted in the middle of a character sequence that might otherwise be considered a valid identifier in its own right, it can be disambiguated by enclosing the reference in braces,a la shell substitution:

This will result in theZed variable being set to "X_Y" ifREMOTE_HOST is "X" andREQUEST_METHOD is "Y".

Flow Control Elements

The basic flow control elements are:

Theif element works like an if statement in a programming language. The test condition is evaluated and if the result is true, then the text until the nextelif,else orendif element is included in the output stream.

Theelif orelse statements are used to put text into the output stream if the originaltest_condition was false. These elements are optional.

Theendif element ends theif element and is required.

test_condition is a boolean expression which follows theap_expr syntax. The syntax can be changed to be compatible with Apache HTTPD 2.2.x usingSSILegacyExprParser.

The SSI variables set with thevar element are exported into the request environment and can be accessed with thereqenv function. As a short-cut, the function namev is also available insidemod_include.

The below example will print "from local net" if client IP address belongs to the 10.0.0.0/8 subnet.

The below example will print "foo is bar" if the variablefoo is set to the value "bar".

Legacy expression syntax

This section describes the syntax of the#if expr element ifSSILegacyExprParser is set toon.

string

true ifstring is not empty

-A string

true if the URL represented by the string is accessible by configuration, false otherwise. This is useful where content on a page is to be hidden from users who are not authorized to view the URL, such as a link to that URL. Note that the URL is only tested for whether access would be granted, not whether the URL exists.

Example

<!--#if expr="-A /private" -->
Click <a href="/private">here</a> to access private information.
<!--#endif -->

string1 =string2
string1 ==string2
string1 !=string2

Comparestring1 withstring2. Ifstring2 has the form/string2/ then it is treated as a regular expression. Regular expressions are implemented by thePCRE engine and have the same syntax as those inperl 5. Note that== is just an alias for= and behaves exactly the same way.

If you are matching positive (= or==), you can capture grouped parts of the regular expression. The captured parts are stored in the special variables$1 ..$9. The whole string matched by the regular expression is stored in the special variable$0

Example

<!--#if expr="$QUERY_STRING = /^sid=([a-zA-Z0-9]+)/" -->
<!--#set var="session" value="$1" -->
<!--#endif -->

string1 <string2
string1 <=string2
string1 >string2
string1 >=string2

Comparestring1 withstring2. Note, that strings are comparedliterally (usingstrcmp(3)). Therefore the string "100" is less than "20".

(test_condition )

true iftest_condition is true

!test_condition

true iftest_condition is false

test_condition1 &&test_condition2

true if bothtest_condition1 andtest_condition2 are true

test_condition1 ||test_condition2

true if eithertest_condition1 ortest_condition2 is true

"=" and "!=" bind more tightly than "&&" and "||". "!" binds most tightly. Thus, the following are equivalent:

The boolean operators&& and|| share the same priority. So if you want to bind such an operator more tightly, you should use parentheses.

Anything that's not recognized as a variable or an operator is treated as a string. Strings can also be quoted:'string'. Unquoted strings can't contain whitespace (blanks and tabs) because it is used to separate tokens such as variables. If multiple strings are found in a row, they are concatenated using blanks. So,

SSIEndTagDirective

This directive changes the string thatmod_include looks for to mark the end of an include element.

SSIEndTag "%>"

See also

• SSIStartTag

SSIErrorMsgDirective

TheSSIErrorMsg directive changes the error message displayed whenmod_include encounters an error. For production servers you may consider changing the default error message to"<!-- Error -->" so that the message is not presented to the user.

This directive has the same effect as the<!--#config errmsg=message --> element.

SSIErrorMsg "<!-- Error -->"

SSIETagDirective

Under normal circumstances, a file filtered bymod_include may contain elements that are either dynamically generated, or that may have changed independently of the original file. As a result, by default the server is asked not to generate anETag header for the response by addingno-etag to the request notes.

TheSSIETag directive suppresses this behaviour, and allows the server to generate anETag header. This can be used to enable caching of the output. Note that a backend server or dynamic content generator may generate an ETag of its own, ignoringno-etag, and this ETag will be passed bymod_include regardless of the value of this setting.SSIETag can take on the following values:

off

no-etag will be added to the request notes, and the server is asked not to generate an ETag. Where a server ignores the value ofno-etag and generates an ETag anyway, the ETag will be respected.

on

Existing ETags will be respected, and ETags generated by the server will be passed on in the response.

SSILastModifiedDirective

Under normal circumstances, a file filtered bymod_include may contain elements that are either dynamically generated, or that may have changed independently of the original file. As a result, by default theLast-Modified header is stripped from the response.

TheSSILastModified directive overrides this behaviour, and allows theLast-Modified header to be respected if already present, or set if the header is not already present. This can be used to enable caching of the output.SSILastModified can take on the following values:

off

TheLast-Modified header will be stripped from responses, unless theXBitHack directive is set tofull as described below.

on

TheLast-Modified header will be respected if already present in a response, and added to the response if the response is a file and the header is missing. TheSSILastModified directive takes precedence overXBitHack.

SSILegacyExprParserDirective

As of version 2.3.13,mod_include has switched to the newap_expr syntax for conditional expressions in#if flow control elements. This directive allows to switch to theold syntax which is compatible with Apache HTTPD version 2.2.x and earlier.

SSIStartTagDirective

This directive changes the string thatmod_include looks for to mark an include element to process.

You may want to use this option if you have 2 servers parsing the output of a file each processing different commands (possibly at different times).

SSIStartTag "<%"SSIEndTag   "%>"

The example given above, which also specifies a matchingSSIEndTag, will allow you to use SSI directives as shown in the example below:

See also

• SSIEndTag

SSITimeFormatDirective

This directive changes the format in which date strings are displayed when echoingDATE environment variables. Theformatstring is as instrftime(3) from the C standard library.

This directive has the same effect as the<!--#config timefmt=formatstring --> element.

SSITimeFormat "%R, %B %d, %Y"

The above directive would cause times to be displayed in the format "22:26, June 14, 2002".

SSIUndefinedEchoDirective

This directive changes the string thatmod_include displays when a variable is not set and "echoed".

SSIUndefinedEcho "<!-- undef -->"

XBitHackDirective

TheXBitHack directive controls the parsing of ordinary html documents. This directive only affects files associated with theMIME-typetext/html.XBitHack can take on the following values:

off

No special treatment of executable files.

on

Anytext/html file that has the user-execute bit set will be treated as a server-parsed html document.

full

As foron but also test the group-execute bit. If it is set, then set theLast-modified date of the returned file to be the last modified time of the file. If it is not set, then no last-modified date is sent. Setting this bit allows clients and proxies to cache the result of the request.

Note

You would not want to use the full option, unless you assure the group-execute bit is unset for every SSI script which might#include a CGI or otherwise produces different output on each hit (or could potentially change on subsequent requests).

TheSSILastModified directive takes precedence over theXBitHack directive whenSSILastModified is set toon.