title: What's wrong with having cgi.fix_pathinfo = 0?
body: <p>I'm trying to set up <code>nginx</code> for handling <code>php</code> requests. <a href="https://www.nginx.com/resources/wiki/start/topics/examples/phpfcgi/#notes" rel="nofollow">This link</a> says: </p>
  
  <blockquote>
    <p>This guide run fine on php.ini cgi.fix_pathinfo = 1 (the default). Some guide insist to change it to cgi.fix_pathinfo = 0 but doing that make PHP_SELF variable broken (not equal to DOCUMENT_URI).</p>
  </blockquote>
  
  <p>However, <a href="https://www.nginx.com/resources/wiki/start/topics/tutorials/config_pitfalls/#passing-uncontrolled-requests-to-php" rel="nofollow">this one</a> doesn't make such warnings:</p>
  
  <blockquote>
    <p>Set cgi.fix_pathinfo=0 in php.ini. This causes the PHP interpreter to only try the literal path given and to stop processing if the file is not found.</p>
  </blockquote>
  
  <p>Judging from <a href="http://php.net/manual/en/ini.core.php#ini.cgi.fix-pathinfo" rel="nofollow"><code>php</code> docs</a>:</p>
  
  <blockquote>
    <p>Setting this to 1 will cause PHP CGI to fix its paths to conform to the spec. A setting of zero causes PHP to behave as before. It is turned on by default. You should fix your scripts to use SCRIPT_FILENAME rather than PATH_TRANSLATED.</p>
  </blockquote>
  
  <p>It's better stick with the default value.</p>
  
  <p>So, first how to reproduce broken <code>PHP_SELF</code> variable? Then, which is it? Is setting <code>cgi.fix_pathinfo</code> to 0 a good idea? Or should I choose some other solution?</p>