note 30977 deleted from function.extract by sniper

Note Submitter: noel.darlow2@virgin.net ---- IMPORTANT The post by.. destes (at) ix.netcom.com 13-May-2002 03:13 shows how to save time by extracting GET vars in one line BUT this is very unsafe, given that GET vars are vulnerable to query string tampering. A hacker could exploit this to over-write any variable in the same scope as the extract() line. extract($_POST, EXTR_PREFIX_ALL, "prefix"); ..would fix it (as long as you choose a "prefix" which doesn't re-create any existing var names). I've seen people using extract() in the same way for $_POST vars - same deal.