As the others have indicated, parameters are the way to go.

In a pinch, though, you can simply double-up the single quotes to tell SQL Server to accept it as a single quote. See this thread for more:

https://stackoverflow.com/questions/1912095/how-to-insert-a-value-that-contains-an-apostrophe-single-quote

Thanks,
JoeK