Inserting Strings Into An Mssql Dbase

The scenario is that the user enters a description of a special offer into a text box and then can add that record to a database field using the insert method of asp. However, an error occurs if the description has any apostrophes in. For example,

special offer 1: andy's prize plums
could cause an error because the insert looks something like this

"insert into offersTable(offerDescription) values (' " & request.form("description") & "'"

is there some way to escape all naughty characters so they don't cause a problem. Any suggestions very welcome.