Preventing XSS injection in querystring

I have a CI3 site that is vulnerable to XSS injection via the querysting:

https://thesite.com/search?q=x'><svG onLoad=alert(document.domain)>

I have all inputs going through

Code:

$this->input->get('q', true)

so it's protected at the server end but still runs when the page is loaded with the malicious querystring.

How can the execution of the javascript be prevented?