Update SQL Statement

I started here only it doesn't work with single quotes in the name. It does work if there are no single quotes.
strSQL = "select * from Members WHERE co_name = '" & request("coname") & "'"

I get this error Microsoft JET Database Engine (0x80040E14)
Syntax error (missing operator) in query expression 'co_name = 'aa'a aaa'aa''
So I tried this:
strSQL = "select * from Members WHERE co_name = '" & replace(request("coname"), "'", "''") & "'"
It kind of works but stops outputing at the first space it encounters. It works good if there are no single quotes in the name. I'm writing the output to an input box.
In fact here is the code for the input box:
Response.Write "<td><input name=coname tabindex=5 value= '" & objRs("co_name") & "'></td>"