XPath 2.0 allows a quote within a string to be escaped by doubling it (as in SQL) (not by escaping with "\" as in C or Java).
XPath 1.0 provides no such mechanism. You can write ' within a string delimited by ", or " within a string delimited by '. If you want both, you have to use concat():
text() = concat("He said,", '"', "I won't", '"')
Author, XSLT Programmer's Reference and XPath 2.0 Programmer's Reference