Remove extract() call on untrusted input

As per recommendation in PHP manual http://php.net/extract, drop use of
extract() on input from $_FILE superglobal.