PHP Includes in a '.html' File Without Manipulating .htaccess?

[Hyp3r grunt]

I've ran into a big problem. On my website all the pages have '.html' extensions. They're all capable of running php because of my '.htaccess' file. I also have a feed that updates itself automatically by using php and pulling information from a database. Below is my '.htaccess' file.


Addhandler application/x-httpd-php .html .php
Addhandler application/x-httpd-php .xml .php


I want to run PHPBB 2 on my website and when I install it and try to log in I get this error:

'Fatal error: SUHOSIN - Use of eval is forbidden by configuration in /home/halonirv/public_html/phpBB2/includes/template.php(174) : eval()'d code on line 174'

I asked my host about it because I thought it had something to do with them and I got this response:

'The problem was with your PHP handlers in your .htaccess file. I commented them out and it should work now.'

He took my '.htaccess' and put '#'s in front of the commands. This made PHPBB 2 work but it made it so the pages with '.html' extensions were no longer capable of running PHP. I'm not sure about my feed. (It's file extension was '.xml' and it was RSS version 2)

So what do I do to make it so I can run PHP on pages that end with '.html' and '.xml' and make PHPBB 2 work as well?

[Acid]

The first thing I would try is change the occurences of "Addhandler" to "AddHandler" as .htaccess commands are case sensitive.

Another thing to check is how PHP is running on your host, is it running as CGI or as an Apache module? If it's running as CGI then use AddHandler, however if it's running as an Apache module then you could instead try:

AddType application/x-httpd-php .html .xml

[Hyp3r grunt]

The changing 'Addhandler' to 'AddHandler' didn't do anything and replacing everything in my '.htaccess' file with 'AddType application/x-httpd-php .html .xml' made the forum work but the website had an 500 internal server error.

UPDATE: I found out that if I deleted everything from my '.htaccess' file and replaced it with 'AddHandler application/x-httpd-php .html .xml' it made the forum and the website work like a wanted. Am I putting myself at a security risk or anything because this seems to good to be true. Is there any fault that can come of putting

AddHandler application/x-httpd-php .html .xml

instead of


Addhandler application/x-httpd-php .html .php
Addhandler application/x-httpd-php .xml .php


?

[felgall]

You only need one statement and just list all the extensions you want to map on the end. Mapping .php is redundant since it is already mapped correctly and trying to map it again may be puting it into an infinite loop and causing the error you were having.

[aedrin]

I think generally it is a bad thing to apply the PHP parser to filetypes not designed to handle them. It's not impossible as you show, but it's not recommended.

[Hyp3r grunt]

What would your alternative method be aedrin? My website depends on everything being able to run php.

[GJay]

I think generally it is a bad thing to apply the PHP parser to filetypes not designed to handle them. It's not impossible as you show, but it's not recommended.

Nonsense, there's no reason whatsoever (other than confusion for future developers, so no 'technical' reason) why you shouldn't setup PHP to parse any text file you like. The extension is just a dot and some characters, it has no meaning. Having php parse .html, .css and .js, and image files (jpg, gif, png etc.) is fairly common.

[aedrin]

It's nice of you to give the reason for me. :)

[felgall]

The only reason for not setting up PHP to parse everything is that it means that every piece of your page gets parsed for PHP even when it doesn't contain any. If all your .html file contain PHP then it makes sense to parse .html files, if only one or two .html files contain PHP and the other thousand .html pages don't then it makes sense to change the extension on those couple of files rather than have PHP parsing all the others unnecessarily and slowing everything down.