Zennoxa Shield
Rules / PHP
SHIELD-PHP-018

Variable overwrite via extract on request data

highPHPCWE-621CVSS 8.1

What it detects

extract() applied to request superglobals lets attackers overwrite arbitrary local variables.

How to fix

Avoid extract() on user input; access specific request keys explicitly.

Vulnerable — Shield flags thisform.php
<?php
// legacy form handler
extract($_POST);
if ($is_admin) {
    grantAdminAccess($user_id);
}
Fixed — scans cleanform.php
<?php
// form handler — read only the fields we expect
$user_id = (int) ($_POST['user_id'] ?? 0);
$comment = trim($_POST['comment'] ?? '');
saveComment($user_id, $comment);

Both snippets are verified against the shipped scanner: the vulnerable one triggers SHIELD-PHP-018, the fixed one does not.

Scan your repo freeFull documentation
Back to all rules
SHIELD-PHP-018: Variable overwrite via extract on request data — Zennoxa Shield