Essentially, the only characters that needs escaping are the single quote ' and backslash \

Both of these characters can be escaped by doubling them up. For example, "INSERT INTO "wibble&qout; (field1) VALUES ('It''s all mine\\ours')"