You should indeed escape the character. So a ' in string becomes '' (two single ones). See this part of the documentation: https://world.mendix.com/display/refguide5/String+function+calls
Regards,
Ronald