Option 1 (Not the good method)
Try replacing " with \"
theString = replace(theString,"""", "\""")
Option 2 (Good method)
Use parameterised SQL statements instead of building the query like you have done
Please check the following tutorial and example:
http://www.aspfaq.com/params.htm