It is good practice, anytime you update or insert strings into a SQL database, to pass the values through a function that handles the quotes. Example, in ASP I do something this:
function f_SafeQuotes(inputstring)
f_SafeQuotes = replace(inputstring," ' ", " '' ")
end function
...
conn.execute "insert into test (ID,name) values (1," & f_SafeQuotes(namevar) & ")"