Make all pages .php?

[Martin Lucas-Smith]

Re: Make all pages .php?



[color=blue]
> If you really want to hide your technology there's an easier way. At
> your domain registrar have the name server forward with masking. This
> hides all file names.[/color]

All this does is create a 100%-size frame, which prevents users
bookmarking your pages, creates issues for search engines, results in your
site being listed by search under the 'real' domain name rather than the
masked name, and is trivial to break out of to find the real file names.



Martin Lucas-Smith www.geog.cam.ac.uk/~mvl22

https://www.lucas-smith.co.uk

[Martin Lucas-Smith]

Re: Make all pages .php?



[color=blue]
> Using:
> DirectoryIndex index.html index.jsp index.shtml index.php index.htm
>
> ...in Apache encapsulates the server-side technology you use fairly
> well.[/color]

No it doesn't - that merely avoids you having to specify a filename for
the default file in a directory, i.e.

https://www.site.com/directory/

rather than

https://www.site.com/directory/index.html

(which is good practice in itself, not least as you can then just link to
"/directory/" rather than "/directory/index.html".)


[color=blue]
> Using URLs with .php in them seems like a questionable practice to me -
> but then so it using URLs with .html in them - for the same reason.[/color]

Sorry, I don't see your point.



Don't forget, if you really want to hide your server technology, you
should also prevent your server spewing it out in the HTTP headers.

http://webtools.mozilla.org/web-sniffer/view.cgi?url=www.geog.cam.ac.uk

for instance gives no indication whatsoever that that site is using PHP.

Do this by setting
expose_php = Off
in your php.ini or presumably
php_flag expose_php Off

(Personally I believe the developers should switch this off by default.)


Martin Lucas-Smith www.geog.cam.ac.uk/~mvl22

https://www.lucas-smith.co.uk

[Adams-Blake Co.]

Re: Make all pages .php?

Jean-Baptiste Nizet wrote:
[color=blue]
> Adams-Blake Co. wrote:
>[color=green]
>> Jean-Baptiste Nizet wrote:
>>
>>
>>[color=darkred]
>>>>Is there any advantage or disadvantage to making all files .php, or the
>>>>same for mixing them with .htm files?
>>>>
>>>>What do you do, and why?
>>>>
>>>
>>>All my pages are PHP
>>>
>>>Here are my reasons:
>>>- I'm using sessions. If the user only plays with .htm URLs for a small
>>>period, the session will expire, and it shouldn't expire since the user
>>>is still using the site.[/color]
>>
>>
>> I have to question this. Where is this documented? I did some testing. I
>> have
>> a aaaa.php page with a pop-up link (_blank) that passes a querystring to
>> bbb.php page which does a header redirect to an myhelp.html "help" screen.
>> I can close the pop-up and my session variables have not gone away and my
>> application continues to function normally
>>
>> Even if I had a link from a php page to an .html page, I don't see where
>> the server would know to cancel the session.
>>
>> I'm not saying you are wrong, its just that I have not experienced this.
>> Have others?
>>
>> Al
>>
>>[/color]
>
> It's simple. Here's how sessions work: each time session_start() is
> called, PHP updates a timestamp associated with the session ID contained
> in the session cookie (or in the URL is URL rewriting is used). If
> session_start() is not called for, let's say 20 minutes, and if PHP is
> configured to time out sessions after, let's say 10 minutes, then the
> next time session_start() is called, the session has been removed.
> So, if during the 20 minutes you're still browsing the web site without
> calling any PHP page, session_start() will never be called, and the
> session will be lost.
>
> look at http://www.php.net/manual/en/ref.session.php for more details.
>
> JB.[/color]


Yes, JB. You are right. I see what you mean. But in your earlier post you
seemed to be saying that by going to a html page you would lose your session.
The only reason you would loose the session is if you stayed on the page too
long. That's the same if you link to a .PHP page. The difference is that you
get an extra amount of time on a php page because the time stamp will be
updated.

But in actual practice it probably won't make much difference. If you come
into page1.php at 12:00 noon. You stay on the page one minute. You click a
link to pageA.html and stay on that for 3 minutes. You come back to page1.php
you still have plenty of time.

If you spend 30 minutes on page2.html, you will lose your session.

The big difference is if you spent 19 minutes on page1.php and then went off
to page2.HTML. you would not update the clock and only have a few minutes.

So, yes I see where you are coming from on this. So what you are saying is
that if we have mostly html pages, we should still have a
<?php
session_start() ;
?>

<html>
<head>
<body>
etc.

that starts off the page and make it a .php and not a html page, correct?

Al

[D K Woods]

Re: Make all pages .php?

[color=blue]
> But in actual practice it probably won't make much difference. If you come
> into page1.php at 12:00 noon. You stay on the page one minute. You click a
> link to pageA.html and stay on that for 3 minutes. You come back to page1.php
> you still have plenty of time.
>
> If you spend 30 minutes on page2.html, you will lose your session.
>[/color]

I didn't read it as spending X time on *one* .html page, but that the
problem arises on a site with some .php and some .html, when a user doesn't
happen to return to a .php page before the session expires. He could be
happily jumping from page to page to page, and if he just never happens to
hit a .php page the session's gone.

One way to avoid this is to create a php file named 'session_refres h.php':

<?
session_start() ;
?>

Then in all you non-php .html files, just call it like this:
<SCRIPT LANGUAGE=Javasc ript SOURCE="session _refresh.php"></SCRIPT>

As far as the script tag is concerned it's an empty file and gets ignored
but it still runs the php.

Though you might run into problems if the user doesn't have cookies
enabled. I'm not sure about the specifics of URL rewriting. Has anyone
tried this option?

david
--
It is of interest to note that while some dolphins are reported to have
learned English -- up to 50 words used in correct context -- no human being
has been reported to have learned dolphinese.
-- Carl Sagan


-----= Posted via Newsfeeds.Com, Uncensored Usenet News =-----
http://www.newsfeeds.com - The #1 Newsgroup Service in the World!
-----== Over 100,000 Newsgroups - 19 Different Servers! =-----

[Gerhard Fiedler]

Re: Make all pages .php?

On Thu, 18 Sep 2003 09:39:06 -0500, D K Woods wrote:
[color=blue]
>One way to avoid this is to create a php file named 'session_refres h.php':
>
><?
>session_start( );
>?>
>
>Then in all you non-php .html files, just call it like this:
><SCRIPT LANGUAGE=Javasc ript SOURCE="session _refresh.php"></SCRIPT>
>
>As far as the script tag is concerned it's an empty file and gets ignored
>but it still runs the php.[/color]

are you sure that this gets run as php? even though the "master" file
is html? looks kind of strange, in terms of control of whether or not
a file gets interpreted.

[Phil Roberts]

Re: Make all pages .php?

With total disregard for any kind of safety measures Gerhard
Fiedler <me@privacy.net > leapt forth and uttered:
[color=blue]
> On Thu, 18 Sep 2003 09:39:06 -0500, D K Woods wrote:
>[color=green]
>>One way to avoid this is to create a php file named
>>'session_refr esh.php':
>>
>><?
>>session_start ();
>>?>
>>
>>Then in all you non-php .html files, just call it like this:
>><SCRIPT LANGUAGE=Javasc ript
>>SOURCE="sessi on_refresh.php" ></SCRIPT>
>>
>>As far as the script tag is concerned it's an empty file and
>>gets ignored but it still runs the php.[/color]
>
> are you sure that this gets run as php? even though the "master"
> file is html? looks kind of strange, in terms of control of
> whether or not a file gets interpreted.
>[/color]

<script> tag links are just making a normal HTTP request for the
file, so if you specify a PHP file then it will be executed.

--
There is no signature.....

[John Dunlop]

Re: Make all pages .php?

Phil Roberts wrote:
[color=blue]
> <script> tag links are just making a normal HTTP request for the
> file, so if you specify a PHP file then it will be executed.[/color]

Possibly. But heed the familiar caveat: this falls flat on its face
with user agents that do not or will not support scripting.

--
Jock

[Jeff Skeith]

Re: Make all pages .php?

fyi... check with you hosting company. my host won't send html files
through php so that means i must use php extensions.


jskeith1@san.rr .com (Jeff Skeith) wrote in message news:<ce78746a. 0309172038.1b69 a34@posting.goo gle.com>...[color=blue]
> bruce, why not go with apache? it is pretty simple to set up on
> windows. do a google for apache install tutorial on win2000. php was
> designed to work with apache.
>
> also, i kinda like the idea of making html files automatically go to
> the php processor. i think i'll set my site up like that in which
> case all my files will be html and all will be php processed since
> that's a requirement anyway due to my include statements.
>
> "Bruce W...1" <bruce@noDirect Email.com> wrote in message news:<3F6892BF. 7526E047@noDire ctEmail.com>...[color=green]
> > Martin Lucas-Smith wrote:[color=darkred]
> > >
> > > I am a strong believer that, for best practice, one should never use .php
> > > but use .html instead. Certainly using a mixture is asking for trouble.
> > > The same applies to nasty extensions like .php3, .php4, .phtml and the
> > > like.
> > >
> > > Using .php advertises your server technology, is less familiar to people
> > > if you are having to print an address, results in you having to change all
> > > your URLs if you then decide to change to some other technology, and can
> > > result in a mixture of .html and .php. Also, if you then decide to add
> > > bits of PHP to an existing .html file you don't then have to change the
> > > URL (and mess about with redirections).
> > >
> > > Given that many sites these days will be using PHP for some sort of house
> > > style use (as well as anything else..) PHP will, by definition, need to be
> > > parsing most if not all files. Therefore, set .html to be parsed for PHP.
> > >
> > > I've never encountered any noticable performance hit, even on sites that
> > > barely make use of the PHP parser. I dare say there might be on an
> > > extremely busy site, but I suspect most people would never run into that
> > > and the above maintenance advantages outweigh the disadvantages.
> > >[/color]
> > =============== =============== =============== =============== =
> >
> > That makes sense, but how do you set .html to be parsed for PHP? I'm using IIS
> > on Windows 2000. I suspect this is done in IIS?
> >
> > If that's the case I'm screwed because I use a hosting company (also running Win
> > 2000) and they would not let me access the IIS settings. But perhaps they
> > already have it setup this way, I'll ask.
> >
> > Thanks.[color=darkred]
> > > Just add
> > >
> > > AddType application/x-httpd-php .html
> > >
> > > to your .htaccess file or Apache config. What could be simpler?
> > >
> > > Martin Lucas-Smith www.geog.cam.ac.uk/~mvl22
> > > www.lucas-smith.co.uk[/color][/color][/color]

[Tim Tyler]

Re: Make all pages .php?

Martin Lucas-Smith <mvl22@cam.ac.u k> wrote or quoted:
[color=blue][color=green]
>> Using URLs with .php in them seems like a questionable practice to me -
>> but then so it using URLs with .html in them - for the same reason.[/color]
>
> Sorry, I don't see your point.[/color]

URLs are part of the public API of your web site.

If you expose the server-side technology you are using, you lose the
opportunity to change it at a later date - without breaking existing
links.
[color=blue]
> Don't forget, if you really want to hide your server technology, you
> should also prevent your server spewing it out in the HTTP headers.[/color]

I don't mind the occasional:

Server: Apache/1.3.28 (Unix) PHP/4.3.3
X-Powered-By: PHP/4.3.3

....or two in my HTTP headers ;-)
--
__________
|im |yler http://timtyler.org/ tim@tt1lock.org Remove lock to reply.

[Andy Jeffries]

Re: Make all pages .php?

On Tue, 30 Sep 2003 10:36:10 +0000, Tim Tyler wrote:[color=blue]
> URLs are part of the public API of your web site.
>
> If you expose the server-side technology you are using, you lose the
> opportunity to change it at a later date - without breaking existing
> links.[/color]

RewriteEngine on
RewriteRule ^(.*)\.html $1.php [R]

That should do it. That way you can easily change your server technology
and people coming from bookmarks will get redirected.

Cheers,


Andy

[Martin Lucas-Smith]

Re: Make all pages .php?



[color=blue][color=green][color=darkred]
> >> Using URLs with .php in them seems like a questionable practice to me -
> >> but then so it using URLs with .html in them - for the same reason.[/color]
> >
> > Sorry, I don't see your point.[/color]
>
> URLs are part of the public API of your web site.
>
> If you expose the server-side technology you are using, you lose the
> opportunity to change it at a later date - without breaking existing
> links.[/color]

That was my point entirely - .html isn't specific to any particular
technology and is preferable to using .php (especially when the site is
substantially making use of PHP parsing on most page)

(Good point about the API - I'd never really considered it in those terms,
but you're absolutely correct.)

[color=blue][color=green]
> > Don't forget, if you really want to hide your server technology, you
> > should also prevent your server spewing it out in the HTTP headers.[/color]
>
> I don't mind the occasional:
>
> Server: Apache/1.3.28 (Unix) PHP/4.3.3
> X-Powered-By: PHP/4.3.3
>
> ...or two in my HTTP headers ;-)[/color]

Neither does anyone trying to hack your server :)


Martin Lucas-Smith www.geog.cam.ac.uk/~mvl22

https://www.lucas-smith.co.uk

[jim]

Re: Make all pages .php?

Question......( assumption-->AddType application/x-httpd-php .html)
Is the php parser/interpreter invoked only when <?php is encountered on
a web page? Or does it scan all accessed .html docs regardless of
existing php code on that page?


Martin Lucas-Smith wrote:[color=blue]
>
>[color=green][color=darkred]
>>>>Using URLs with .php in them seems like a questionable practice to me -
>>>>but then so it using URLs with .html in them - for the same reason.
>>>
>>>Sorry, I don't see your point.[/color]
>>
>>URLs are part of the public API of your web site.
>>
>>If you expose the server-side technology you are using, you lose the
>>opportunity to change it at a later date - without breaking existing
>>links.[/color]
>
>
> That was my point entirely - .html isn't specific to any particular
> technology and is preferable to using .php (especially when the site is
> substantially making use of PHP parsing on most page)
>
> (Good point about the API - I'd never really considered it in those terms,
> but you're absolutely correct.)
>
>
>[color=green][color=darkred]
>>>Don't forget, if you really want to hide your server technology, you
>>>should also prevent your server spewing it out in the HTTP headers.[/color]
>>
>>I don't mind the occasional:
>>
>> Server: Apache/1.3.28 (Unix) PHP/4.3.3
>> X-Powered-By: PHP/4.3.3
>>
>>...or two in my HTTP headers ;-)[/color]
>
>
> Neither does anyone trying to hack your server :)
>
>
> Martin Lucas-Smith www.geog.cam.ac.uk/~mvl22
> www.lucas-smith.co.uk
>[/color]

[Tim Tyler]

Re: Make all pages .php?

Andy Jeffries <news@andyjeffr ies.remove.co.u k> wrote or quoted:[color=blue]
> On Tue, 30 Sep 2003 10:36:10 +0000, Tim Tyler wrote:[/color]
[color=blue][color=green]
>> URLs are part of the public API of your web site.
>>
>> If you expose the server-side technology you are using, you lose the
>> opportunity to change it at a later date - without breaking existing
>> links.[/color]
>
> RewriteEngine on
> RewriteRule ^(.*)\.html $1.php [R][/color]

That will redirect EVERY .html page request to fetch a .php page.
[color=blue]
> That should do it. That way you can easily change your server technology
> and people coming from bookmarks will get redirected.[/color]

I guess I don't see what reason there is for making the mistake in the
first place and then patching things up retrospectively with an ugly hack
- or an ugly sequence of hacks if you can't transform your whole site
at once - or are using a mixture of page technologies.
--
__________
|im |yler http://timtyler.org/ tim@tt1lock.org Remove lock to reply.

[Martin Lucas-Smith]

Re: Make all pages .php?



[color=blue]
> Question......( assumption-->AddType application/x-httpd-php .html) Is
> the php parser/interpreter invoked only when <?php is encountered on a
> web page? Or does it scan all accessed .html docs regardless of existing
> php code on that page?[/color]

My understanding is that it will scan it (well, it has to...) but that the
interpreter presumably won't get invoked.

I've found that, even with a fairly busy server serving 30 virtualHosts
covering 10,000 real pages, Apache still takes a mere fraction of system
resources to serve this, with all .html files being parsed for PHP. OK, on
a major international site maybe that wouldn't apply, but I suggest it
will be good enough for the vast majority of uses.


Martin Lucas-Smith www.geog.cam.ac.uk/~mvl22

https://www.lucas-smith.co.uk

[Justin Koivisto]

Re: Make all pages .php?

Martin Lucas-Smith wrote:[color=blue][color=green]
>>This is a best practices question.
>>
>>For a website where PHP is used, does it make sense to have both .htm
>>and .php files? In other words, for pages that have no active content
>>there's no point in naming them with a .php extension.
>>
>>Is there any advantage or disadvantage to making all files .php, or the
>>same for mixing them with .htm files?[/color]
>
> I am a strong believer that, for best practice, one should never use .php
> but use .html instead. Certainly using a mixture is asking for trouble.
> The same applies to nasty extensions like .php3, .php4, .phtml and the
> like.[/color]

I, on the otherhand believe that you shouldn't use an extension.
[color=blue]
> Using .php advertises your server technology, is less familiar to people
> if you are having to print an address, results in you having to change all
> your URLs if you then decide to change to some other technology, and can
> result in a mixture of .html and .php. Also, if you then decide to add
> bits of PHP to an existing .html file you don't then have to change the
> URL (and mess about with redirections).[/color]

This is my reasoning... Say I have 5 pages on my site:
index.html - the home page
contact.html - contact information
products.html - listing of the products I sell
quotes.html - email quote form results to me
search.html - site search using Google's site:domain stuff

---
Now, I have decided that my contact page needs a form to email me, so I
use formmail.pl...
---
Yuk, I don't like that so now I decide to write a PHP script instead.
Now my page and all links need to be changed to contact.php
---
Uh oh, I have too many products to add to do updates manually all the
time, let's look at PHP/MySQL.. --> products.php
---
Now I am updating 2 databases for my products! I use MS SQL in-house, so
I'll connect to that from the website. Damn, my host doesn't support MS
SQL in PHP... however, they do have ASP as well... --> products.asp
---
Damn, need to change my form to mail script to asp as well! --> contact.asp
---
I need a better way to handle all these messages about quotes, dump to
database, and have in-house software dole it out the the lemmings -->
quotes.asp
---
Hmm, this search would be great if I could search for in-stock items
first... search.asp
---
My host can blow themselves! Need to switch to a more reliable company.
What? No ASP... well, at least there's JSP -->
index.html - the home page
contact.jsp - contact information
products.jsp - listing of the products I sell
quotes.jsp - email quote form results to me
search.jsp - new site search
---
really need to separate the products -->
products.jsp?ca tegory=xx&prod_ num=xx

(I think you see the pattern here...)

Now, if I had done this differently, I would have started by using
something to avoid showing file extensions in the first place
(mod_rewrite or ISAPI_rewrite)!

If I would have done that, I would have had:
/ - the home page
/contact/ - contact information
/products/ - listing of the products I sell
/quotes/ - email quote form results to me
/search/ - site search

they would never have changed, and when I decided to break apart the
product listings, I would have had:
/products/category/prod_num/

Now, it doesn't matter what I call my files. If they change, the URI
will stay the same! ;)
[color=blue]
> Given that many sites these days will be using PHP for some sort of house
> style use (as well as anything else..) PHP will, by definition, need to be
> parsing most if not all files. Therefore, set .html to be parsed for PHP.[/color]

Doing this will make all files with the .html extension start the PHP
processor. PHP will then search through the file for any opening <?php
tags before returning result. Not very efficient if you have a large
html file that gets hit all the time.
[color=blue]
> I've never encountered any noticable performance hit, even on sites that
> barely make use of the PHP parser. I dare say there might be on an
> extremely busy site, but I suspect most people would never run into that
> and the above maintenance advantages outweigh the disadvantages.[/color]

Remember, if you are in a shared server environment, your small hit
combined with the other 1200 sites on that server add up very quickly!
[color=blue]
> Just add
> AddType application/x-httpd-php .html
> to your .htaccess file or Apache config. What could be simpler?[/color]

Not much, but more efficient is better.

My $.02

--
Justin Koivisto - spam@koivi.com
PHP POSTERS: Please use comp.lang.php for PHP related questions,
alt.php* groups are not recommended.