It actually isn't. This example won't execute on page load, but it will if someone clicks in the search box.

http://fluin.com/?search=Search%22%20onclick=alert%28documen...

Since you're using PHP, I recommend you use a function like htmlspecialchars here rather than whatever kind of filtering you're doing.