extract() on request data
Why it matters
extract() turns every request field into a variable, so an attacker can overwrite variables such as $is_admin just by adding a field to the form.
extract($_POST);
if ($is_admin) {
show_admin_panel();
}$name = trim((string)($_POST['name'] ?? ''));
$email = filter_var($_POST['email'] ?? '', FILTER_VALIDATE_EMAIL);How to fix
Read only the fields you need, one by one. extract() lets attackers overwrite your variables.
Scan my code
Scan my code β
Paste a file and PHP Safe points to every line that matches this rule.