Welcome to WebmasterWorld Guest from 126.96.36.199
Your best solution in this case is to add a meta tag only on the pages that have additional characters (?xyz).
Use <META NAME="robots" CONTENT="noindex"> just for those pages, and let the robots index your straight mysite.php page.
Duplicate content is a nightmare of a problem, and once you let it happen, it is extremely difficult to remove it from the SE databases. Even variations in upper and lower case characters are seen as unique pages (mysite.php versus MySite.php). Think of robots as case sensitive and literal UNIX devices, and you should be safe.