Breaking it down makes it a bit easier.
NSUserDefaults *p = [NSUserDefaults standardUserDefaults];
NSString* string1 = [[p valueForKey:@"user"] stringByAddingPercentEscapesUsingEncoding:NSASCIIStringEncoding];
NSString* string2 = [[p valueForKey:@"pass"] stringByAddingPercentEscapesUsingEncoding:NSASCIIStringEncoding];
NSString* string3 = [[tvQ.text stringByReplacingOccurrencesOfString:@"\n" withString:@" "] stringByAddingPercentEscapesUsingEncoding:NSASCIIStringEncoding];
NSString* urlString = [NSString stringWithFormat:@"http://website.com/phpscript.php?user=%@&pass=%@&cat=%@&sub=%@&body=%@",string1,string2,sport,@"",string3];
id val1 = [NSString stringWithContentsOfURL:[NSURL URLWithString:urlString]];
[p setObject:val1 forKey:@"q"];
So p is a dictionary object loaded from user defaults, looks like some login credentials that are probably saved from last time the app was run.
stringByAddingPercentEscapesUsingEncoding is a standard method that makes it safe to transmit characters like ' ' (space) or '%' in a request. It is applied to the strings to ensure the request will reach the server looking like it was intended.
String1 and String2 are the username and passwords presumably. String3 is the body of the query I guess.
When the URL is built it executes the query represented by urlString (the code will pause at this point while the fetch is executed - hopefully this whole block is already on a secondary thread). The result of the query is stored in dictionary p and can be accessed through a key @"q".
Handling ampersands explicitly:
[myString replaceOccurrencesOfString:@"&" withString:@"%26" options:NSCaseInsensitiveSearch range:wholeString];
This method can be applied to any string - if it is applied to the same string twice then the second time it will do nothing.