云主机使用Nginx+PHP时PHP文件下载而非执行？script_filename错误

# ❌ 潜在风险配置
fastcgi_param SCRIPT_FILENAME $document_root$fastcgi_script_name;

# ✅ 安全配置：使用$realpath_root自动解析真实路径
fastcgi_param SCRIPT_FILENAME $realpath_root$fastcgi_script_name;

# ❌ 错误：alias场景下$document_root不等于/data/app/
location /app/ {
    alias /data/app/;
    location ~ \.php$ {
        fastcgi_pass unix:/run/php/php-fpm.sock;
        fastcgi_param SCRIPT_FILENAME $document_root$fastcgi_script_name;
        # $document_root可能是/var/www/html，而非/data/app/
        # 最终路径变成 /var/www/html/app/index.php → 文件不存在 → 下载
    }
}

# ✅ 正确：alias场景下显式指定完整路径
location /app/ {
    alias /data/app/;
    location ~ \.php$ {
        fastcgi_pass unix:/run/php/php-fpm.sock;
        fastcgi_param SCRIPT_FILENAME /data/app$fastcgi_script_name;
        include fastcgi_params;
    }
}

# ❌ 错误：先设置参数再include，可能被覆盖
location ~ \.php$ {
    fastcgi_pass unix:/run/php/php-fpm.sock;
    fastcgi_param SCRIPT_FILENAME $realpath_root$fastcgi_script_name;
    include fastcgi_params;  # 如果fastcgi_params中也定义了SCRIPT_FILENAME，会覆盖上面的值！
}

# ✅ 正确：先include基础参数，再覆盖特定参数
location ~ \.php$ {
    fastcgi_pass unix:/run/php/php-fpm.sock;
    include fastcgi_params;
    fastcgi_param SCRIPT_FILENAME $realpath_root$fastcgi_script_name;
}

; /etc/php/8.2/fpm/pool.d/www.conf
; 如需支持其他扩展名，显式声明
security.limit_extensions = .php .phtml

; php.ini 或 pool配置中
open_basedir = /var/www/html:/tmp:/usr/share/php

systemctl status php8.2-fpm
# 确认active (running)状态，检查监听地址/Socket路径
ss -lnp | grep php-fpm

error_log /var/log/nginx/error.log debug;

# 假设Nginx配置的root为/var/www/html，请求URI为/test/index.php
# 手动验证拼接后的路径
ls -la /var/www/html/test/index.php

# 确认PHP-FPM运行用户有读取权限
sudo -u www-data test -r /var/www/html/test/index.php && echo "READABLE" || echo "DENIED"

tail -f /var/log/php8.2-fpm.log
# 关注 "No input file specified"、"open_basedir restriction" 等关键字

server {
    listen 80;
    server_name example.com;
    root /var/www/html;
    index index.php index.html;

    location / {
        try_files $uri $uri/ /index.php?$query_string;
    }

    location ~ \.php$ {
        # 防止PATH_INFO攻击
        fastcgi_split_path_info ^(.+?\.php)(/.*)$;

        # 安全检查：确认文件确实存在
        try_files $uri =404;

        fastcgi_pass unix:/run/php/php8.2-fpm.sock;
        fastcgi_index index.php;

        # 先include基础参数，再覆盖SCRIPT_FILENAME
        include fastcgi_params;
        fastcgi_param SCRIPT_FILENAME $realpath_root$fastcgi_script_name;

        # 性能优化
        fastcgi_buffer_size 128k;
        fastcgi_buffers 4 256k;
        fastcgi_busy_buffers_size 256k;
        fastcgi_read_timeout 300;
    }

    # 禁止访问隐藏文件
    location ~ /\. {
        deny all;
    }
}