$result is empty?
use mysql_num_rows to know your table has users.
did you handled the mysql errors ? mysql_error()
see your source code, undifined variables can break your dropdown's structure.
extract in your while function is not a good idea, you would overwrite your previous important values.
use htmlspecialchars if you use entries from a database. What if i use a script name as my firstname ?
use quotes:
echo "<option value=\"{$id}\">{$id}, {$lastname}, {$firstname}</option>\n";