location / {
  try_files <%= try_files%>;
}

location ~ \.php$ {
  fastcgi_split_path_info ^(.+\.php)(/.+)$;
  include fastcgi_params;
  fastcgi_param PATH_INFO         $fastcgi_path_info;
  fastcgi_param SCRIPT_FILENAME   $document_root$fastcgi_script_name;
  fastcgi_index index.php;
  fastcgi_pass  phpfpm<%= port %>;
}

location / {
  try_files <%= try_files%>;
}

location ~ \.php$ {
  try_files $uri =404;
  fastcgi_split_path_info ^(.+\.php)(/.+)$;
  include fastcgi_params;
  fastcgi_param PATH_INFO         $fastcgi_path_info;
  fastcgi_param SCRIPT_FILENAME   $document_root$fastcgi_script_name;
  fastcgi_index index.php;
  fastcgi_pass  phpfpm<%= port %>;
}

Fix "uncontrolled requests to PHP" vulnerability
Fix "uncontrolled requests to PHP" vulnerability

* @see
http://wiki.nginx.org/Pitfalls#Passing_Uncontrolled_Requests_to_PHP
