There are two ways to view an SHTML file, and it is crucial to understand the difference:
SSI is extremely lightweight. For simple inclusion tasks, it requires far less processing power than a PHP engine or client-side XHR requests. view shtml
<!--#include virtual="/header.html" -->
<!--#include file="footer.html" -->
Use #echo to display dynamic server information. This is excellent for debugging or legal disclaimers. There are two ways to view an SHTML
<p>Document Name: <!--#echo var="DOCUMENT_NAME" --></p>
<p>Referrer: <!--#echo var="HTTP_REFERER" --></p>
<p>Remote IP: <!--#echo var="REMOTE_ADDR" --></p>
Yes and No.
However, if you are maintaining a legacy corporate website, a university portal built in the early 2000s, or working on a strict embedded system (like a router interface), you will absolutely encounter SHTML. Use #echo to display dynamic server information
<!--#config timefmt="%Y-%m-%d %H:%M:%S"-->
<!DOCTYPE html>
<html lang="en">
<head>
<meta charset="utf-8" />
<title>Site — View</title>
<!--#include virtual="/includes/head.html"-->
</head>
<body>
<!--#include virtual="/includes/header.html"-->
<main>
<h1>View: /docs/example</h1>
<p>Last generated: <!--#echo var="DATE_LOCAL"--></p>
<!--#if expr="$QUERY_STRING = 'show=full'">
<section>
<h2>Full View</h2>
<!--#include file="full-content.html"-->
</section>
<!--#else-->
<section>
<h2>Summary View</h2>
<p>This is the summary. <a href="?show=full">Show full</a></p>
</section>
<!--#endif-->
<section>
<h2>Server info</h2>
<ul>
<li>Document root: <!--#echo var="DOCUMENT_ROOT"--></li>
<li>Request URI: <!--#echo var="REQUEST_URI"--></li>
</ul>
</section>
</main>
<!--#include virtual="/includes/footer.html"-->
</body>
</html>
| Risk | Explanation |
|------------------------------|-----------------------------------------------------------------------------|
| Information disclosure | Viewing raw .shtml on a misconfigured server may reveal file paths, comments, or SSI directives containing sensitive includes. |
| SSI injection | If user input is used inside an #exec directive, an attacker could run commands on the server. |
| Local file inclusion (LFI)| #include file="..." can be manipulated to read system files if not sanitized. |
Recommendation: Disable
#execunless absolutely necessary. Always sanitize any user data used in SSI directives.