How can nginx run a file with jpg extension as a php file?
This is not strictly an Nginx problem, but rather is an issue with old versions of PHP. It has been fixed for quite a long while (I'm not sure exactly what version, but it certainly isn't a concern with PHP 7.0). The answers to this question:
https://serverfault.com/q/627903/377662
Explain the underlying issue and solution in detail. The short answer is that what you are calling "virtual directories" are common in many web server applications (including Apache and Nginx) and are used so that the website can show nice urls (aka /categories/5) instead of (categories.php?id=5). Imagine this flow:
- User: Server, please give me
/categories/5 - Server (to itself): Hmm...
/categories/5isn't a file - Server (to itself): That's okay, this rule says that
categories.phpknows what to do - Server: PHP, The user requested
/categories/5, andcategories.phpshould be able to handle that. Can you tell me what to return? - PHP: Okay, I talked to
categories.phpand here is your answer! - Server: User, here is the contents of
/categories/5
Which is generally a fairly straightforward exchange. The server has done everything properly - PHP needs to know not just the name of the file to execute, but also the details about what URL was originally requested.
Unfortunately older versions of PHP used to get confused and, despite being told by the server that categories.php was the thing to execute, would sometimes attempt to "fix" the information coming from the server and may end up executing a different file than what the server actually suggested. This would lead to PHP executing test.jpg on the basis of the fact that the original URL was test.jpg/whatever.php, even though the server told it to execute a completely different file.
This should no longer be a relevant issue at all. If you are worried though, you can just set the fix_pathinfo directive to 0 in your php.ini file. Again, full details and background are explained extensively in the answers to this question.