You're on the right track in thinking that you need to escape the single quote, but on the wrong track in thinking that you need to do this in the database.

It suffices to "escape" the single quotes right before you emit the Javascript. Try something like the following (untested, but I've done something like this before a few years back):

# after you've fetched the row

my $escapedCustno = jsescape($custno);
...
print <<EndHTML;
<script language="javascript">
fillCustomer('$escapedCustno', ...

sub jsescape {
    my $str = shift;
    $str =~ s/("')/\\$1/g;
    $str;
}
[download]