[4mnt]

I'm pretty sure $login can be set to true/false somewhere on top of the file as 'configuration'. Only it gets overwritten by the call to extract().

It was not meant to be user input

[p4bl0]

I feel stupid. Of course, you are right.

[heydenberk]

Don't feel stupid. This is difficult to reason about, hence the existence of the bug and the inadvisability of PHP's `extract` function.