function no_injection($string){
	$string = htmlspecialchars($string);
	$string = trim($string);
	$string = stripslashes($string);
	$string = mysql_real_escape_string($string);
return $string;
}

$_GET['query'] = no_injection($_GET['query']);