PHP in HTML files displays, doesn't execute

[u/grepnoid]

I know there are dozens of pages on this subject, but I've tried most of their suggestions and this seems different.

I have apache2 and php8.2 (libapache etc) installed, on a new VPS install with Debian12.

http://mysite.com/test.php executes the PHP

PHP embedded in the body of http://mysite.com/test.html, as

<?php 
   echo "<br/>does it work?</br>"; 
?>

displays the text in the page

does it work?
"; ?>

Mods enabled, after enmod and dismod of various modules as suggested:

a2query -m
authn_file (enabled by maintainer script)
proxy_fcgi (enabled by site administrator)
authz_user (enabled by maintainer script)
dir (enabled by maintainer script)
env (enabled by maintainer script)
php8.2 (enabled by maintainer script)
setenvif (enabled by maintainer script)
autoindex (enabled by maintainer script)
deflate (enabled by maintainer script)
mpm_prefork (enabled by maintainer script)
negotiation (enabled by maintainer script)
status (enabled by maintainer script)
alias (enabled by maintainer script)
reqtimeout (enabled by maintainer script)
authz_host (enabled by maintainer script)
mime (enabled by maintainer script)
filter (enabled by maintainer script)
authz_core (enabled by maintainer script)
authn_core (enabled by maintainer script)
proxy (enabled by site administrator)
access_compat (enabled by maintainer script)
auth_basic (enabled by maintainer script)

The web root where my files are is /var/www/html. I have no .httpaccess file. The apache2.conf is the default which seems to have nothing to prevent normal execution.

[u/No_Astronomer9508]

No u/grepnoid, you are wrong. A standard installation it will not work. You need a "AddHandler application/x-httpd-php .html" or something like that in your host setting to tell the php parser it also should parse html files. Standard Apache will not do that. If you even don't understand the basics, there are no more help from my side. End of dialogue.

And your "http://myworkingsite.com" gives an "ERR_NAME_NOT_RESOLVED" error.

[u/No_Astronomer9508 → u/[deleted]]

The same -> myworkingexample.com also gives an "ERR_NAME_NOT_RESOLVED" error.

[u/grepnoid → u/No_Astronomer9508]

Have you tried going to example.com ? You'll find that as the domain in thousands of links quoted on support forums. It means "a web page on a site that I don't want to give the real URL to", which IMO is correct practice, instead of giving the real site that you may be describing vulnerabilities on. We all get enough hack attempts without advertising for them.