SSI, XSSI & CGI variables

Alphabetical list of variables
SSI environment variables
CGI environment variables
XSSI environment variables
Table of time format codes

See also An Introduction to... Server Side Includes (SSI)

Alphabetical list of variables

This is a list of the environment variables available to SSI and XSSI (including CGI variables), with descriptions and examples below:



Please note - I'm no guru - I've just collected this stuff together from various sources on and off the web and put it on one page, primarily for my own reference. Feel free to copy, save and/or print this page, but please don't ask me for help ;o)
(?) before a description indicates I have included it without understanding it myself ... so your guess is as good as mine as to what it really means!
In nearly all cases the last line is a live example (but in a few cases where I have been unsure about the security sensitivity of disclosing information about my server, I have put [RISK ?] instead of an active example).

  Back to top    Back to top

SSI environment variables

These are the 6 SSI environment variables

DATE_LOCAL - Current date and time in the local time zone.

<!--#echo var="DATE_LOCAL" -->

 Wednesday, 20-Sep-2017 22:14:18 CDT

DATE_GMT - Current date and time in GMT (Greenwich Mean Time).

<!--#echo var="DATE_GMT" -->

 Thursday, 21-Sep-2017 03:14:18 GMT

LAST_MODIFIED - Last modification date and time for current file.

<!--#echo var="LAST_MODIFIED" -->

 Sunday, 19-Mar-2006 14:24:49 CST

DOCUMENT_URI - Virtual path (i.e.path relative to the site root) to the file.

<!--#echo var="DOCUMENT_URI" -->


DOCUMENT_NAME - The current filename.

<!--#echo var="DOCUMENT_NAME" -->


QUERY_STRING_UNESCAPED - Undecoded query string with all shell metacharacters escaped with a "\".

<!--#echo var="QUERY_STRING_UNESCAPED" -->


These two are, strictly speaking, SSI directives and not variables, but I have included them here for ease of reference. Note that these do not use 'echo var=' in their arguments.

fsize - Returns the size of specified file, for the example below we have used our home page. Also I have shown the different results acquired using the #config directive.

<!--#fsize virtual="/index.shtml" -->


<!--#config sizefmt="bytes"-->
<!--#fsize virtual="/index.shtml" -->


<!--#config sizefmt="abbrev"-->
<!--#fsize virtual="/index.shtml" -->b


flastmod - Returns the last modifition date of specified file. Again I have used my home page as an example, and illustrated a few of the possibilities of using #config. At the bottom of this page is a table of all the timefmt options.

<!--#flastmod virtual="/index.shtml" -->

 Saturday, 08-Apr-2017 06:21:56 CDT

<!--#config timefmt="%r %A %B %D"-->
<!--#flastmod virtual="/index.shtml" -->

 06:21:56 AM Saturday April 04/08/17

<!--#config timefmt="%T, %a, %b, %d, %Y"-->
<!--#flastmod virtual="/index.shtml" -->

 06:21:56, Sat, Apr, 08, 2017

<!--#config timefmt="(week %U day %w) %y:%j:%H:%M:%S - %Z"-->
<!--#flastmod virtual="/index.shtml" -->

 (week 14 day 6) 17:098:06:21:56 - CDT

  Back to top    Back to top

CGI environment variables

All of the CGI environment variables are also available to SSI

The header lines received from the client, if any, are placed into the environment with the prefix HTTP_ followed by the header name. Any '-' characters in the header name are replaced by '_'.

HTTP_ACCEPT - The MIME types which the client will accept, as given by HTTP headers. Other protocols may need to get this information from elsewhere. Each item in this list should be separated by commas as per the HTTP spec.

Format: type/subtype, type/subtype

<!--#echo var="HTTP_ACCEPT" -->



<!--#echo var="HTTP_ACCEPT_ENCODING" -->

 x-gzip, gzip, deflate

HTTP_ACCEPT_LANGUAGE - Lists the human languages acceptable to the client e.g. 'en-gb' is English (British).

<!--#echo var="HTTP_ACCEPT_LANGUAGE" -->



<!--#echo var="HTTP_CONNECTION" -->


HTTP_HOST - (?) Name of the requesting server.

<!--#echo var="HTTP_HOST" -->

HTTP_REFERER - URL of the page from which a link to the current document was followed.

<!--#echo var="HTTP_REFERER" -->


HTTP_USER_AGENT - The browser the client is using to send the request. General format: software/version library/version.

<!--#echo var="HTTP_USER_AGENT" -->

 CCBot/2.0 (

CONTENT_TYPE - For queries which have attached information, such as HTTP POST and PUT, this is the content type of the data.

<!--#echo var="CONTENT_TYPE" -->


CONTENT_LENGTH - The length of the said content as given by the client.

<!--#echo var="CONTENT_LENGTH" -->


The following environment variables are not request-specific and are set for all requests:

PATH - (?) The active PATH on the server.

<!--#echo var="PATH" -->

[RISK ?]

PATH_INFO - The extra path information, as given by the client. In other words, scripts can be accessed by their virtual pathname, followed by extra information at the end of this path. The extra information is sent as PATH_INFO. This information should be decoded by the server if it comes from a URL before it is passed to the CGI script.

<!--#echo var="PATH_INFO" -->


PATH_TRANSLATED - The server provides a translated version of PATH_INFO, which takes the path and does any virtual-to-physical mapping to it.

<!--#echo var="PATH_TRANSLATED" -->


REMOTE_HOST - The hostname making the request. If the server does not have this information, it should set REMOTE_ADDR and leave this unset.

<!--#echo var="REMOTE_HOST" -->


REMOTE_ADDR - The IP address of the remote host making the request.

<!--#echo var="REMOTE_ADDR" -->

REMOTE_PORT - (?) The port number at which the request was received.

<!--#echo var="REMOTE_PORT" -->


REMOTE_USER - If the server supports user authentication, and the script is protected, this is the username they have authenticated as.

<!--#echo var="REMOTE_USER" -->


REMOTE_IDENT - If the HTTP server supports RFC 931 identification, then this variable will be set to the remote user name retrieved from the server. Usage of this variable should be limited to logging only.

<!--#echo var="REMOTE_IDENT" -->


AUTH_TYPE - If the server supports user authentication, and the script is protects, this is the protocol-specific authentication method used to validate the user.

<!--#echo var="AUTH_TYPE" -->


SCRIPT_FILENAME - The full path on the server to the requested script. i.e. SCRIPT_NAME plus the server path.

<!--#echo var="SCRIPT_FILENAME" -->

[RISK ?]

SERVER_ADDR - The server's DNS address.

<!--#echo var="SERVER_ADDR" -->

SERVER_ADMIN - The server administrator's email address.

<!--#echo var="SERVER_ADMIN" -->

SERVER_NAME - The server's hostname, DNS alias, or IP address as it would appear in self-referencing URLs.

<!--#echo var="SERVER_NAME" -->

SERVER_PORT - The port number to which the request was sent.

<!--#echo var="SERVER_PORT" -->


SERVER_SIGNATURE - (?) Used server error messages.

<!--#echo var="SERVER_SIGNATURE" -->


SERVER_SOFTWARE - The name and version of the information server software answering the request (and running the gateway). Format: name/version

<!--#echo var="SERVER_SOFTWARE" -->


UNIQUE_ID - (?) Serial no. of the server?

<!--#echo var="SERVER_SOFTWARE" -->

[RISK ?]

GATEWAY_INTERFACE - The revision of the CGI specification to which this server complies. Format: CGI/revision

<!--#echo var="GATEWAY_INTERFACE" -->


SERVER_PROTOCOL - The name and revision of the information protcol this request came in with. Format: protocol/revision

<!--#echo var="SERVER_PROTOCOL" -->


REQUEST_METHOD - The method with which the request was made. For HTTP, this is "GET", "HEAD", "POST", etc.

<!--#echo var="REQUEST_METHOD" -->


QUERY_STRING - The information which follows the ? in the URL which referenced this script. This is the query information. It should not be decoded in any fashion. This variable should always be set when there is query information, regardless of command line decoding.

<!--#echo var="QUERY_STRING" -->


REQUEST_URI - The full URL of the request (including the query string).

<!--#echo var="REQUEST_URI" -->


SCRIPT_NAME - A virtual path to the script being executed, used for self-referencing URLs.

<!--#echo var="SCRIPT_NAME" -->


  Back to top    Back to top

xSSI environment variables

XSSI introduced a special directive which returns a value-paired list of all current environment variables (including ones created using the set directive).


A special XSSI command which returns ALL environment variables, including those which have been set within the page. Note that, like flastmod and fsize, it is a directive in itself and does not require 'echo var=' in its argument.

<!--#printenv -->

[RISK ?]

While testing in various environments I've noticed that the list retured by the PRINTENV directive has included variables which are not listed above, but which do seem to work when returned individually from the echo directive.

COMSPEC - (?) Reports the path to COMMAND.COM when run locally in Windows.

<!--#echo var="COMSPEC" -->


DOCUMENT_ROOT - (?) Local path to this file.

<!--#echo var="DOCUMENT_ROOT" -->

[RISK ?]

DOCUMENT_PATH_INFO - (?) Don't know what this is doing here, but I found it in my printenv return.

<!--#echo var="DOCUMENT_PATH_INFO" -->


USER_INFO - (?) Identity of current site as known by the server.

<!--#echo var="DOCUMENT_NAME" -->

[RISK ?]

Finally here's a couple more I found while searching around the web. I don't know if these are SSI, CGI or XSSI or even if they work, but here they are:

PAGE_COUNT - Number of accesses to current document since server was brought on line.

<!--#echo var="PAGE_COUNT" -->


TOTAL_HITS - Total pages served by server since brought on line.

<!--#echo var="TOTAL_HITS" -->


  Back to top    Back to top


This table shows all the options which can be used with the config timefmt directive

(using DATE_LOCAL)
%aabbreviated weekdayTueWed
%dday of month (01-31)0420
%eday of month (1-31) 420
%wday of week (0-6, Sunday=0)23
%jday of year (001 to 366)186263
WEEK (week 1 starts on first Sunday of year)
%U or %Wweek number (00 to 53)2738
%babbreviated monthJulSep
%Bfull monthJulySeptember
%mmonth (01 to 12)0709
%ytwo-digit year0017
%cstandard date and time07/04/00 12:03:21Wed Sep 20 22:14:18 2017
%xstandard date07/04/0009/20/17
%DMM/DD/YY date07/04/0009/20/17
%Xstandard time12:03:2122:14:18
%rstandard time in local notation12:03:21 PM10:14:18 PM
%Tstandard time (24 hr clock)12:03:2122:14:18
%Hhour (00 to 23)1222
%Ihour (01 to 12)1210
%Mminute (00 to 59)0314
%Sseconds (00 to 59)2118
%Z or %ztime zoneGMT Daylight TimeCDT
%nnew line
{Printed from on Wed, 20 Sep, 2017 @ 22:14:18}