For the 10,000 who might be learning about this today, the answer is prepared statements with placeholders for the values, like this pseudocode:

   stmt = driver.prepare("insert into names 
      (firstname, lastname) values (?, ?)");
   stmt.execute("Flannery", "O'Connor");

Syntax varies among database interfaces but this ensures that any odd strings are properly stored by the driver and the application does not need to worry about them. There is also no risk of someone rewriting the SQL statement.