Not able to escape quote in visualforce page?

Question

I have developed this visualforce page based on Jeff Douglas's Roll Your Salesforce Lookup Popup Window

However, when I run a search or create a contact with a quote such as O'Neill or Store's, I get an Unexpected token error. I am wondering what steps I could take to allow to escape quotes.

Here's the visualforce class that I have.

public class ContactLookupControl {

  public Contact contact {get;set;} // new contact to create
  public List results{get;set;} // search results
  public string searchString{get;set;} // search keyword

  public ContactLookupControl() {
    contact = new Contact();
    // get the current search string
    searchString = System.currentPageReference().getParameters().get('lksrch');
    runSearch();  
  }

  // performs the keyword search
  public PageReference search() {
    runSearch();
    return null;
  }

  // prepare the query and issue the search command
  private void runSearch() {
    // TODO prepare query string for complex serarches & prevent injections
    results = performSearch(searchString);               
  } 

  // run the search and return the records found. 
  private List performSearch(string searchString) {

    String soql = 'select id, name,account.Name,MailingStreet,MailingCity,MailingState,MailingPostalCode,MailingCountry,Phone,Email from contact';
    if(searchString != '' && searchString != null)
      soql = soql +  ' where name LIKE \'%' + searchString +'%\'';
    soql = soql + ' limit 25';
    System.debug(soql);
    return database.query(soql); 

  }

  // save the new contact record
  public PageReference saveContact() {
    insert contact;
    contact=[select id,name,FirstName,LastName,AccountId,MailingStreet,MailingCity,MailingState,MailingPostalCode,MailingCountry,Phone,Email from contact where id=:contact.id];
    // reset the contact
    //contact = new Contact();
    return null;
  }

  // used by the visualforce page to send the link to the right dom element
  public string getFormTag() {
    return System.currentPageReference().getParameters().get('frm');
  }

  // used by the visualforce page to send the link to the right dom element for the text box
  public string getTextBox() {
    return System.currentPageReference().getParameters().get('txt');
  }
  }

Page

Answer 1

You will want to use the escapeSingleQuotes Apex method.

  // run the search and return the records found. 
  private List performSearch(string searchString) {

      String soql = 'select id, name,account.Name,MailingStreet,MailingCity,MailingState,MailingPostalCode,MailingCountry,Phone,Email from contact';
      if(searchString != '' && searchString != null)
        soql = soql +  ' where name LIKE \'%' + String.escapeSingleQuotes(searchString) +'%\'';
      soql = soql + ' limit 25';
      System.debug(soql);
      return database.query(soql); 
  }

Should do the trick just fine.