The information gets urlencoded when passed by using GET; the standard function is to call urldecode:
e.g.
$encoded = "SELECT+*+FROM+student+WHERE+studentid+%3D+%27S001 %27";
$cleanup = urldecode($encoded);

which makes $cleanup become:
SELECT * FROM student WHERE studentid = 'S001'

Cheers

Dan