I think your where clause is messed up - try

WHERE contacts.forename = '$search' OR
contacts.surname = '$search' OR
CONCAT(contacts.forename, ' ', contacts.surname) = '$search'