How to make MySQL search queries with quotes

Woah there. You’ve just opened up a can of SQL injection.

I use the default get_query_var(‘s’) that I believe is automatically escaped by wordpress.

Not quite – get_search_query() will do that, but get_query_var( 's' ) gets the “raw” value.

Regardless, always use wpdb::prepare or similar escaping before executing SQL:

$query = $wpdb->prepare( "SELECT * FROM $table WHERE query = %s", $search_query );
$item  = $wpdb->get_row( $query );

if ( $item === null ) {
     $wpdb->insert( $table, [ 'query' => $search_query ] );
}

Check out the awesome helper method wpdb::insert too.