if (isset($_POST['q']))
    $search = sanitize($_POST['q']);
else if (isset($_GET['q']))
    $search = sanitize($_GET['q']);

function sanitize($str) {
	$str = strip_tags($str);
	$str = str_replace("&", "&", $str);
	$str = htmlspecialchars($str, ENT_QUOTES, "ISO-8859-1");
	return $str;
}