Addslashes should work just fine since \" and \' get interpreted as just " and ' by the database. Besides that you should be checking any string entered by the user for it's validity, and for protection. If using ' or " will break your search a user could use it to do malicious things, like deleting every record from your database.
Just imagine a user entering a search string like this:
";DELETE * FROM table1
The " ends your actual search string, and the ; ends the SQL select command, and then the DELETE command gets run, this could be very bad. This type of "hack" is what most malicious script-kiddies do when they find a system that doesn't check what it's users are inputing.
