SQL Insert check for single quote in sql statement

I am using a text area to collect some string data which will be updated to an external database what do I need to gaurd against a single quote being entered which will cause an error in sql syntax in my string. I am using the following to build my sql string

String sqlUpdate = "INSERT INTO message (messageID, sender, subject, body) VALUES ('"+ messageID + "', '" + sender + "', '" + subject + "', '" + body + "')";

thanks

JakeStart Free Trial