Usually you have to escape any quotes  in your SQL statement. You should
check the documentation for your SQL server to determine how to escape
quotes exactly. I am not sure whether the escaping mechanism is
specific to each database or if there is a standard.

In MySQL, for example, you escape the single or double quote  with a
backslash:

\'
\"

As for non ASCII characters, perhaps someone else can make some
suggestions, as I have no practical experience with it.