Question: Does changing the `.htacces` file to allow the programmer to have **PHP** codes in an HTML file (extension `.html`) compromise with the security of the page?

Is that the reason why files with any **PHP** scripting are given the extension `.php`?

Answer: 
No. It does not yield any security problem if the file is interpreted and executed as a php file. You can even make any extension like ".asp",".jsp" anything you want. Furthermore this may sound a more secure way since an attacker sees the extension and thinks that it is an asp file. 

However in my opinion it is not a good practice and may make development more confusing. I think if it is a php file the extension should be .php

If your desire is to provide security You should check url rewriting and hiding the extension. This way is a more convenient approach.
Actually, having your files containing PHP scripts bear .html extensions provides more security, not less. This kind of security, known as "security by obscurity", affords a small measure of protection. When a malicious hacker comes across an HTML page, s/he may assume that the page was produced by HTML rather than being the output of a page containing a PHP script. However, if the hacker is sophisticated, s/he could verify whether you run PHP on your server by checking header info returned by the web server. It's a good idea to set the php.ini setting `expose_php = Off` to avoid exposing PHP in the header information; see [Manual](http://php.net/manual/en/ini.core.php#ini.expose-php).

If you use a .htaccess file or are able to modify your web server configuration settings, it will impact performance by having all HTML files parsed by the PHP interpreter, including those pages that contain pure HTML. Sending pages that don't require PHP parsing is undoubtedly a wasted effort, but the amount of time involved is reputedly insignificant. If you can modify the settings in your web server's config file, that's preferable since using a .htaccess file may cause your website to perform a little slower.

This kind of security is insufficient in itself to provide optimal security. You still must regard all form data as possibly tainted and validate it. Know what your form values should be and test for those values. The best security involves multiple layers of protection.

See the [Manual](http://php.net/manual/en/security.hiding.php) for more ideas about "security by obscurity". Note, that page does not recommend URL rewriting as a security measure, although it is an option. One should have a very good understanding about URL rewriting since the subject is far from trivial. 

> 
> "... it is easy to make mistakes when configuring mod\_rewrite which can
>  turn into security issues." (See [Apache Week, mod\_rewrite](http://www.apacheweek.com/issues/02-02-01))
> 
> 
> 

However, if you neglect to set `expose_php = Off` in your php.ini file the URL rewriting may not really hide the PHP as you might suppose. If you run a php script containing this line:

```
print_r(get_headers($url,1));

```

you could get back some very revealing info, as the following partial result shows when I set $url to a page at one of my favorite sites:

```
Array
(
    [0] => HTTP/1.1 200 OK
    [Server] => nginx/1.6.2
    [Date] => Thu, 18 Dec 2014 09:59:06 GMT
    [Content-Type] => text/html; charset=utf-8
    [Connection] => close
    [X-Powered-By] => PHP/5.5.11-2

```