afaik, register globals must be off for extract() to even have any signifigance, ie:
extract($GET);
extract($POST);
if ($button)
{
//
}
page.php?button=1 is still going to trigger, regardless if it's your 'form' value
I would recommend just doing this:
extract($GET);
extract($POST);
if ($_POST['button'])
{
// It's safe to use $name now
}
Or even foreach()'n, but, I guess it's up to you.