Whenever I receive data from an untrusted source I do a string replace and change a quote (') to a tick (`) character. Even if I forget to change it back later for display purposes, people get the idea anyway.

If it is a trusted source of mine, it does not have a quote (') in the first place.