Standard Function for Escaping Strings in SQL

Question

I'm writing a program in .NET2.0 and I need to escape the inputs before using them. Unfortunately the standard parameter method system does not fully work in the system I'm using. Using the ODBCCommand class I cannot place a ? parameter in the select part of the statement (which is required for the little bit of trickiness I'm doing) without getting an error, so I need to manually escape strings that may or may not contain a single quote ('). Any suggestions?

Edit- Example SQL:

As I would like it:

INSERT INTO TABLE_A (COLUMN_A, COLUMN_B)
SELECT (?, COLUMN_C)
FROM TABLE_B
WHERE COLUMN_D = ?

As it is:

INSERT INTO TABLE_A (COLUMN_A, COLUMN_B)
SELECT ('INPUT_VALUE_HERE', COLUMN_C)
FROM TABLE_B
WHERE COLUMN_D = ?

Edit: Sybase ASE is the DB driver, through ODBC

Answer 1

Dim s As String = "Michael O'Flatley"
Dim escapedString as String = s.Replace("'", "''")

Answer 2

You can parse your string parameters with this extension function

public static string SqlEncode(string str)
{
    if (str == null) return String.Empty;
    return str.Replace("'","''");
}