extract()

What is extract() in PHP?

extract() is a built-in PHP function that imports the elements of an associative array into the current symbol table — turning each key into a variable whose value is the matching array element. It is the inverse of compact(), which builds an array from existing variables.

Its signature is:

extract(array &$array, int $flags = EXTR_OVERWRITE, string $prefix = ""): int

• $array — the source array. Only string keys that are valid PHP variable names become variables. Numeric keys are skipped unless you use a prefix flag.
• $flags — controls how name collisions with existing variables are handled (see Flags and behavior).
• $prefix — a string prepended to variable names when a prefix flag is used.

It returns the number of variables successfully imported.

How to use extract() in PHP

Start with an associative array whose keys are the variable names you want:

$person = [
    'name'  => 'John Doe',
    'age'   => 30,
    'email' => '[email protected]',
];

extract($person);

echo $name;   // John Doe
echo $age;    // 30
echo $email;  // [email protected]

After extract($person), three variables — $name, $age, and $email — exist in the current scope, each holding the value of the corresponding key.

Extracting only some keys

By default, extract() creates variables for every key. To import a subset, filter the array first with array_intersect_key() and array_flip():

$wanted = ['name', 'email'];
$count = extract(array_intersect_key($person, array_flip($wanted)));

echo $count;  // 2
echo $name;   // John Doe
echo $email;  // [email protected]
// $age is NOT created

array_flip($wanted) turns ['name', 'email'] into ['name' => 0, 'email' => 1], and array_intersect_key() keeps only those keys from $person, so just $name and $email are extracted.

Flags and behavior

The second parameter controls how existing variables are handled when a key collides with a variable that already exists. The most common flags are:

Compare EXTR_OVERWRITE (the default) with EXTR_SKIP:

$name = 'Existing Name';
$data = ['name' => 'New Name'];

extract($data);             // default: overwrites
echo $name;                 // New Name

$name = 'Existing Name';
extract($data, EXTR_SKIP);  // keep what's already set
echo $name;                 // Existing Name

Use EXTR_PREFIX_ALL to namespace every variable and avoid collisions entirely:

$data = ['name' => 'John', 'age' => 30];
extract($data, EXTR_PREFIX_ALL, 'user');

echo $user_name;  // John
echo $user_age;   // 30

Security warning

Because extract() creates variables dynamically from keys, feeding it untrusted data can overwrite existing variables — including critical ones or superglobals such as $_GET, $_POST, and $_SESSION. A classic vulnerability is extract($_GET), which lets an attacker set any variable in your script via the query string:

$is_admin = false;
extract($_GET);          // ?is_admin=1 now makes $is_admin truthy — dangerous!

Never call extract() directly on request data. When you must, pass EXTR_SKIP so existing variables can't be clobbered, or whitelist keys with array_intersect_key() as shown above.

When to use extract()

extract() shines in narrow, controlled situations:

• Template rendering — a view engine extracts a known data array into local variables right before including a template, so the template can write $title instead of $data['title'].
• Configuration unpacking — turning a small, trusted config array into named variables at the top of a script.

For most code, explicit assignment is clearer and safer than extract(), because a reader can see exactly which variables come into scope. Reach for it only when the keys are trusted and the readability win is real.

Summary

extract() imports an associative array's keys as variables in the current scope and returns how many it created. Its default EXTR_OVERWRITE behavior makes it powerful but risky: always filter or use EXTR_SKIP with untrusted input. To go the other direction — build an array from variables — use compact().

Practice