SQL Injections

Found a ton of SQL injections, there's surely more in your code elsewhere. I suggest using PDO Prepared Statements in the future and why not break this into multiple files, perhaps classes or at least sanitize the items coming out of extract(). :)