How to insert a string that contains ' or ,

Hello,

i am using the following statement to insert a message from a user
into the database.

updStmt.executeUpdate("INSERT INTO Contact (uId, replyAddr, subject,
msg) "+
                               "VALUES (" + userId + "," +
                               "\'" + replyAddr + "\'," +
                               "\'" + subject + "\'," +
                               "\'" + msg + "\')");

The variables userId, replyAddr, subject und msg are of type String.
Now if one of the Strings contain a ' or a , character, the sql
statement gets messed up and causes a SqlException. Is there a way
(How) can i store a string that contains ' or , in the database?
Thanks in advance for your assistance.