Before you do a write operation to the database you must start a new transaction. This is done with the $db->begin() function. Then you need to escape the data which you want to store, this is done with the $db->escapeString() function.

  // prepare the data for database storage
  $str = $db->escapeString( "Testing escaping'\"" );

  // start a new transaction
  $db->begin();
  // send the SQL INSERT command to the database
  $db->query( "INSERT INTO sql_test ( name, description ) VALUES ( 'New test', '$str' )" );
  // commit the transaction
  $db->commit();

  // fetch the last automatically incremented value
  $rowID = $db->lastSerialID( "sql_test", "id" );