extract() Security Risk

TL;DR

Explanation

extract(array $array) creates one variable per key in the current scope. extract($_POST) is as dangerous as register_globals — attackers can set any variable: ?role=admin overwrites $role. Even with EXTR_PREFIX_ALL, if the prefix is known it can be targeted. Extract should only be used with trusted, bounded arrays (configuration, template variables) and never with user input. PHP_CodeSniffer and PHPStan flag extract() usage. Rector can suggest replacements. Use explicit variable assignment or list()/array destructuring instead.

Common Misconception

Why It Matters

Common Mistakes

• Calling extract($_POST) or extract($_GET) for convenience.
• Using extract() in template files where variables could be overwritten.
• Not knowing extract() overwrites existing variables by default (EXTR_OVERWRITE).

Code Examples

// extract() on user input — catastrophic
extract($_POST); // ?role=admin&authenticated=1
if ($authenticated && $role === 'admin') {
    // Attacker gains admin access
}

// Explicit extraction — only what you need:
$username = filter_input(INPUT_POST, 'username', FILTER_SANITIZE_SPECIAL_CHARS);
$email    = filter_input(INPUT_POST, 'email',    FILTER_VALIDATE_EMAIL);

// If you must use extract, use trusted bounded data:
$templateVars = ['title' => 'Home', 'year' => date('Y')];
extract($templateVars, EXTR_SKIP); // Never user input

References

• ↗ https://www.php.net/manual/en/function.extract.php

Tags

Related Terms