Confirm this with the PostGreSQL docs, but SQL is generally quoted as follows:

$expr =~ s/'/''/g;
$expr = "'$expr'";
[download]

Some DBs will require that you escape backslashes too. I didn't take non-printables into account. You probably won't have those in reports, except maybe a new line. Really, you should check the database's manual. Note: don't expect all databases to quote strings in the same fashion.