You have no escapes on anything before you store it in the table, so using a single quote will result in SQL Errors which in turn makes SQL Injection a possibility.
PHP Code:
function onCreated() {
temp.str = "How's it going!";
echo(temp.str.escape()); // Prints the Escaped String
}