UPDATE: As of WordPress 3.0, get_search_query() sanitizes its output and can be used directly.
Theme authors: the WordPress function get_search_query() is NOT sanitized! Don’t make the same mistake that I have in the past.
For example, this code taken from the LA-School blue theme is not safe:
<p><?php printf(__('You have searched the <a href="%1$s/">%2$s</a> blog archives for <strong>‘%3$s’</strong>.', 'laschool'), get_bloginfo('url'), get_bloginfo('name'), get_search_query()); ?></p>
With that theme, that text will only be shown if there are search results meaning the code can’t easily be exploited in this particular theme, but it’s still unsafe. The proper way would be wrap the function in attribute_escape() like this:
<p><?php printf( __('You have searched the <a href="%1$s/">%2$s</a> blog archives for <strong>‘%3$s’</strong>.', 'laschool'), get_bloginfo('url'), get_bloginfo('name'), attribute_escape( get_search_query() ) ); ?></p>
Of course if you don’t need the search query returned and just want to out it directly, then just use the_search_query() which will echo a totally safe version.
) 
@