LIS 525 - Server Side Includes

What Are SSIs?

A Server Side Include (SSI) is a type of HTML comment that directs the server to generate data dynamically whenever the Web page is requested. The basic format of an SSI is

    <!--#command tag="value"...-->

Different servers support different SSIs in different ways, but many commands, such as include and exec, are widely supported.

Web pages that contain SSIs often need to have the extension .shtml as a sign to the server that they need to be processed before being sent to the client. An Apache server can be configured (with the XBitHack on directive) to look for SSIs in regular HTML files which have execute permission.

The command include asks the server to insert the contents of another file. Possible advantages of this include the following.

Saving space on the server.
Easier updating of information common to many files.
Control over who can update certain information.

SSIs can also be used to insert the results of executing programs.

Some disadvantages of SSIs include the following.

Server processing time required to parse documents before sending.
Security risk (e.g, system commands might output confidential information) (for this reason, SSIs are disabled on most Web servers).

Examples of SSI Treatment by Servers

Look at ssi.shtml in your browser. If you are viewing a local copy, you will just see

The following are CGI variables for the server:

The date and time is
The current file is
The WWW Server is

The following are CGI variables for the browser:

You are using

The following executes a command in LINUX to get the directory:
The following shows the contents of file ssiincl.txt:

On the other hand, if you requested a copy on the FIMS intranet you would see something like

The following are CGI variables for the server:

The date and time is Friday April 20 2007

The current file is \\files\intranet$\people\faculty\craven\525\ssi.shtml

The WWW Server is Microsoft-IIS/5.0

The following are CGI variables for the browser:

You are using Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.4) Gecko/20030624 Netscape/7.1 (ax)

The following executes a command in LINUX to get the directory:
The CMD option is not enabled for #EXEC calls

The following shows the contents of file ssiincl.txt: HTTP/1.1 404 Object Not Found Server: Microsoft-IIS/5.0 Date: Fri, 20 Apr 2007 14:10:31 GMT MicrosoftOfficeWebServer: 5.0_Collab X-Powered-By: ASP.NET Connection: close Content-Type: text/html
404 Object Not Found

The exec call would not work because the intranet server is not running Linux. The include command would not work because the server has a problem dealing with the virtual tag; if the (non-preferred) file tag had been used instead, the contents of the file would be correctly included.

If you request the same file from the course's public Web site (http://publish.uwo.ca/~craven/525/ssi.shtml), you will get a server error page; the server is apparently trying to handle the SSI, but is messing up in some fatal way.

For More Information

Apache HTTP Server Documentation Project. 2007. Apache module mod_include. http://httpd.apache.org/docs/mod/mod_include.html. (A bit on configuring Apache for SSIs and explanations of the SSI commands.)
Gundavaram, S. 1996. "Chapter 5: Server Side Includes". CGI Programming. O'Reilly and Associates. http://www.ora.com/catalog/cgi/excerpt/ch05.html. (SSI basics and discussion of the different commands.)
Sol, S. 1999. "SSI (Server Side Includes)". Web Developer's Virtual Library. http://www.wdvl.com/Authoring/Tools/Tutorial/ssi.html. (Basic introduction, followed by a list of common commands.)

Home

Last updated April 25, 2007.
This page maintained by Prof. Tim Craven
E-mail (text/plain only): craven@uwo.ca
Faculty of Information and Media Studies
University of Western Ontario,
London, Ontario
Canada, N6A 5B7