Question: Does changing the `.htacces` file to allow the programmer to have **PHP** codes in an HTML file (extension `.html`) compromise with the security of the page?

Is that the reason why files with any **PHP** scripting are given the extension `.php`?

Answer: 
Actually changing file endings of PHP files is rather dangerous. I experienced some problems first hand:

* Moving your project to a new server may cause the webserver to lose your configuration
* In a rather complex Apache configuration there may be multiple domains to get to your project you did not see in the first place; and one of these configurations may ignore your trick
* A misconfiguration of your webserver may render your clever trick useless (e.g. by using a default configuration)
* Other programmers may confuse your PHP files for HTML files

If one of these cases happen, any programming included in your PHP file can now be read by everybody. If there are configuration settings in your PHP file (DB connections, etc.) or some common programming mistakes (`print $_GET['search'];`) every attacker will now about them.

If your really want to keep your HTML file-ending, consider mod\_rewrite.
The only thing security related that you can add to `.htaccess` is user authentication. Beyond this, there is nothing that `.htaccess` can provide that will enhance the security of your application.

Do not rely on `.htacess` gymnastics for security purposes.

If you are porting over an existing website and doing it in stages, then it makes sense to use the same URL as those that might be bookmarked or referred to by other areas of your application; in this case you can use .html

If possible, try to use redirection and you *can* do that using `.htaccess`; but in some cases (for example, if you are trying to convert an existing file that is the target of a POST form into PHP) adding a redirect will make the form unusable as the payload will be discarded.