if (isset($_POST['q']))
    $search = sanitize($_POST['q']);
else if (isset($_GET['q']))
    $search = sanitize($_GET['q']);

function sanitize($str) {
    $str = strip_tags($str);
    $str = str_replace("&", "&", $str);
    $str = htmlspecialchars($str, ENT_QUOTES, "ISO-8859-1");
    return $str;
}