extract() applied to request superglobals lets attackers overwrite arbitrary local variables.
Avoid extract() on user input; access specific request keys explicitly.