title: Is it safe to use extract( $_REQUEST, EXTR_IF_EXISTS )?
body: <p>Within a function (not a class method), is it safe to use <code>extract( $_REQUEST, EXTR_IF_EXISTS )</code> provided that you define your variables beforehand?</p>
  
  <p>Example:</p>
  
  <pre><code>$a = $b = $c = '';
  extract( $_REQUEST, EXTR_IF_EXISTS );
  </code></pre>
  
  <p>or will this allow PHP globals and other sensitive things to be overwritten by a malicious attacker?</p>