There is array $posted_data that is cleaned out according to the array
$allowable_search_fields set in search.php:
PHP Code:
$allowable_search_fields = array (
"substring",
"by_title",
"by_shortdescr",
"by_fulldescr",
"by_sku",
"extra_fields",
"by_keywords",
"categoryid",
"category_main",
"category_extra",
"search_in_subcategories",
"price_max",
"price_min",
"price_max",
"avail_min",
"avail_max",
"weight_min",
"weight_max",
"manufacturers");
So you can refer it as $posted_data['substring']