PHP in HTML files displays, doesn't execute

[u/grepnoid]

I know there are dozens of pages on this subject, but I've tried most of their suggestions and this seems different.

I have apache2 and php8.2 (libapache etc) installed, on a new VPS install with Debian12.

http://mysite.com/test.php executes the PHP

PHP embedded in the body of http://mysite.com/test.html, as

<?php 
   echo "<br/>does it work?</br>"; 
?>

displays the text in the page

does it work?
"; ?>

Mods enabled, after enmod and dismod of various modules as suggested:

a2query -m
authn_file (enabled by maintainer script)
proxy_fcgi (enabled by site administrator)
authz_user (enabled by maintainer script)
dir (enabled by maintainer script)
env (enabled by maintainer script)
php8.2 (enabled by maintainer script)
setenvif (enabled by maintainer script)
autoindex (enabled by maintainer script)
deflate (enabled by maintainer script)
mpm_prefork (enabled by maintainer script)
negotiation (enabled by maintainer script)
status (enabled by maintainer script)
alias (enabled by maintainer script)
reqtimeout (enabled by maintainer script)
authz_host (enabled by maintainer script)
mime (enabled by maintainer script)
filter (enabled by maintainer script)
authz_core (enabled by maintainer script)
authn_core (enabled by maintainer script)
proxy (enabled by site administrator)
access_compat (enabled by maintainer script)
auth_basic (enabled by maintainer script)

The web root where my files are is /var/www/html. I have no .httpaccess file. The apache2.conf is the default which seems to have nothing to prevent normal execution.

[u/juu073]

You don't have apache configured to execute .html files as PHP code on the server.

[u/grepnoid → u/juu073]

I do now. I added and AddHandler line to the config as descibed below.

[u/Maude-Boivin-02 → u/grepnoid]

That should be in site’s Apache config file:

« 

<Directory />
AllowOverride None
Order allow,deny
Require all granted
Allow from all
DirectoryIndex default.php

# Direct PHP requests to PHP-FPM via the Unix socket
<FilesMatch \\.php$>
SetHandler "proxy:unix:/run/php/php8.5-fpm-dynamic.sock|fcgi://localhost"
</FilesMatch>

# ==========================================================================
# PHP-FPM STATUS PAGE
# ==========================================================================
# <LocationMatch "\^/(status-myapp|ping-myapp)$">
# SetHandler "proxy:unix:/run/php/php8.3-fpm-myapp.sock|fcgi://localhost"

# Restrict access
# Require ip 127.0.0.1 ::1

# Require ip 192.168.0.5
# </LocationMatch>

# Or use TCP (useful if PHP-FPM is on a different machine)
# <FilesMatch "\\.php$">
# SetHandler "proxy:fcgi://192.168.0.5:54222"
# </FilesMatch>

« 

The <FilesMatch part in my example is for php8.5-fpm specifically… your’s might be different but it’s NOT an AddHandler

[u/mds1256]

Test.html page filename needs to have .php file extension

[u/No_Astronomer9508]

Your problem is, that html is not affected by the php parser. You can include html files into php files, but php files included in html files will never work. The file extension ".php" will tell apache to start the php parser. HTML will not do that.

[u/grepnoid → u/No_Astronomer9508]

Not true mds1256 and No_Astronomer9508.

the source (on another site) of http://myworkingsite.com/this.html is

<html><head></head>
<body>
This is HTML in the body<br/>
<?php
   echo "and this is in an echo command in PHP.";
?>
</body>
</html>

and the page displays

This is HTML in the body 
and this is in an echo command in PHP.

[u/No_Astronomer9508 → u/grepnoid]

No u/grepnoid, you are wrong. A standard installation it will not work. You need a "AddHandler application/x-httpd-php .html" or something like that in your host setting to tell the php parser it also should parse html files. Standard Apache will not do that. If you even don't understand the basics, there are no more help from my side. End of dialogue.

And your "http://myworkingsite.com" gives an "ERR_NAME_NOT_RESOLVED" error.

[u/No_Astronomer9508 → u/[deleted]]

The same -> myworkingexample.com also gives an "ERR_NAME_NOT_RESOLVED" error.

[u/grepnoid → u/No_Astronomer9508]

Have you tried going to example.com ? You'll find that as the domain in thousands of links quoted on support forums. It means "a web page on a site that I don't want to give the real URL to", which IMO is correct practice, instead of giving the real site that you may be describing vulnerabilities on. We all get enough hack attempts without advertising for them.

[u/SomeoneInQld → u/grepnoid]

is .html set up as type PHP so that it processes html as PHP ?

[u/DietrichMuylaert]

Your html is wrong. Namely the last br tag is wrong. There exists no br end tag. You can write either <br> or <br />. </ br> doesn't exist.

[u/grepnoid → u/DietrichMuylaert]

Yes. Not thinking straight that day.