When you submit data to your database (using PHP) use addslashes($eachVariable) on each variable holding data to be put in the database.
When you select data from the database use stripslashes() to remove the again.
addslashes example:
$varToAdd = "it's a test";
$query = "INSERT INTO yourTable (theField) VALUES ('".addslashes($varToAdd)."')";
$result = mysql_query($query);
stripslashes example:
$row = mysql_fetch_array($someResult)
echo htmlspecialchars( stripslashes($row["someField"]) );
Hope this clarifies the issue.
About the second question:
Please post your query.
Best regards Nico