Path: csiph.com!3.us.feeder.erje.net!feeder.erje.net!news.linkpendium.com!news.linkpendium.com!panix!not-for-mail From: rcpj@panix.com (Pierre Jelenc) Newsgroups: comp.lang.php Subject: Re: How to link from html form an external php file login? Date: Sun, 12 Jan 2020 00:26:38 +0000 (UTC) Organization: Public Access Networks Corp. Lines: 51 Message-ID: References: NNTP-Posting-Host: panix3.panix.com X-Trace: reader2.panix.com 1578788798 7615 166.84.1.3 (12 Jan 2020 00:26:38 GMT) X-Complaints-To: abuse@panix.com NNTP-Posting-Date: Sun, 12 Jan 2020 00:26:38 +0000 (UTC) X-Newsreader: trn 4.0-test77 (Sep 1, 2010) Originator: rcpj@panix.com (Pierre Jelenc) Xref: csiph.com comp.lang.php:18183 In article , Jerry Stuckle wrote: >On 1/11/2020 5:23 PM, Pierre Jelenc wrote: >> In article , >> Jerry Stuckle wrote: >>> >>> The hosting company (not you) *can* configure the host to parse .html >>> files as php code - but if I saw a hosting company do that I would run >>> as fast as I could. It is a security risk >> >> Why is that? >> >>> as well as a performance >>> problem because every page will be parsed for php code, whether it >>> should be or not. >> >> Except if every page has PHP scripts anyway... >> >> Pierre >> > >Then each page should have a .php extension. Parsing .html files as php >code is still a huge security exposure. But why? I understand that poorly-written PHP is a risk, but that's independent of the file extension. > And any decent sized site will have pages that don't contain any php >code. Not all sites are large, though. > TOC and privacy statement pages come to mind for a start. So do >About Us and other common pages. Unless they all contain common elements, that are conveniently inserted via include, require, auto-prepend, auto-append, and the like. Sure, it's wasting a few cpu cycles and file overheads, but that's not much a problem with modern hardware, while it makes maintenance far easier when there's only one file to edit instead of 20. Any site with a menu will benefit from needing to edit a single included file. Of course there's SSI, but that does not allow tweaking the include on the fly, such as highlighting the name the page currently loaded and disabling its link in the menu. Pierre -- Pierre Jelenc The Gigometer www.gigometer.com The NYC Beer Guide www.nycbeer.org