I would consider it bad idea to use extract() on $_GET (or $_POST) as it may potentially contain things you did not expect. You should know what variables to expect from $_GET and then only allow the script to use those expected variables. A simple way to do what you wish with some restriction of what is used via a pre-defined array of allowed $_GET key names, and query string creation via http_build_query:
PHP Code:
function auaComp($v1, $v2){
return ($v1 != $v2) ? 0 : 1;
}
$allowedGETvars = array('s1' => '', "s2" => '', 's3' => '');
//if the items in $_GET which have the same key name as the
//items in $allowedGETvars do not have the same values as the
//items in $allowedGETvars, they will be returned in $data array
$data = array_uintersect_assoc($_GET, $allowedGETvars, "auaComp");
$urlVars = http_build_query($data, '', '&');
print('<form method="post" action="tictactoe.php?'. $urlVars .'">');
Bookmarks