The best alternative is to use parameterised queries, then you don't have to escape strings.
If you still want to put the query together yourself, the proper way to escape a string literal for SQL Server (T-SQL) is to replace each apostrophe (') in the string with two apostrophes.
