This article was previously published under Q318176
This article has been archived. It is offered "as is" and will no longer be updated.
We strongly recommend that all users upgrade to Microsoft Internet Information Services (IIS) version 7.0 running on Microsoft Windows Server 2008. IIS 7.0 significantly increases Web infrastructure security. For more information about IIS security-related topics, visit the following Microsoft Web site:
When you execute a server-side include (SSI) program by using the <!--#exec cgi--> command on a server that is running either Microsoft Windows NT 4.0 with Service Pack 4 (SP4) or later applied or Microsoft Windows 2000 with Service Pack 2 (SP2) or later applied, the output of the program does not appear on the page. If you run the same program on an unpatched server, the output appears as expected.
After you apply these specified service packs, Internet Information Services (IIS) expects any SSI program that is executed by using the <!--#exec cgi--> command to follow the Common Gateway Interface (CGI) specification. This specification requires CGI programs to print a Content-Type HTTP header before any other output. IIS silently ignores this header and removes it from the final program output that it displays on the page. If the SSI program does not include this header, IIS executes the program but does not display any of its output. This is a change from the behavior of previous versions of Windows, which do not require these headers and which display any included HTTP headers on the page before the rest of the output from the SSI program.
You can make the output appear in one of two ways:
Execute the program by using the <!--#exec cmd--> command instead of the <!--#exec cgi--> command.-or-
Rewrite the program to print the following line, followed by two new lines, before any other output:
This behavior is by design.
To enable SSIs, follow these steps:
Start the Internet Service Manager (ISM), which loads the IIS snap-in for the Microsoft Management Console (MMC).
In the MMC, double-click your computer name in the left pane.
Double-click the Web site for which you want to enable SSI.
Right-click the virtual directory that will contain your SSI-enabled files. To enable SSI for the home directory of a Web site, right-click the Web site.
Click Properties, and then click the Home Directory tab.
Under Execute permissions, click to select Scripts and Executables.
Click OK. Make sure to select any directories that contain SSI-enabled files in the Inheritance Overrides screen.For additional information about how to enable the <!--#exec cmd--> command, click the article number below to view the article in the Microsoft Knowledge Base:
233969 SSIEnableCmdDirective Is Set to FALSE by Default
Steps to Reproduce the Behavior
Enable server-side includes for the home directory of your default Web site.
Compile the following C program on an unpatched Windows NT 4.0 or Windows 2000 server:
Reload http://localhost/ssitest.shtm on a computer that is running Windows NT 4.0 SP4 or later or Windows 2000 SP2 or later. You now see the following:
Exec cmd: Content-type: text/html Hello WorldExec cgi: Hello World
Note that unlike the <!--#exec cgi--> command, the <!--#exec cmd--> command does not remove any CGI headers from the output.
For more information about SSIs, see the "Server-Side Includes" topic in the IIS online documentation. To view this topic, locate Administration, locate Web Site Management, and then locate Server-Side Includes. The IIS online documentation is accessible through the following URL from any computer with the IIS documentation installed: