quote in string

Hi, I have a function and it's interface is :

    my_flexible_sql_function(cmd)

where cmd is another sql command.  I call this function like this:

select * from my_flexible_sql_function('select * from employee where
id < 100')

Inside this functioin, I will first retrieve all data by calling
'select * from employee where id < 100' and do some calculation about
the result and then return.

No I run into a problem, I need to call it like this:

select * from my_flexible_sql_function('select * from employee where
dep ='Eng'    ')

But looks like there is a problem to include a string inside the cmd.
The way I write 'Eng' is not right. Is there a way to include quote in
string?

Thanks,

ff