各位大侠请问SQL语句中的引号到底要怎么写?

编译时总是提示SQL语句有错误,但是里面的引号把我给搞晕了,不知道到底应该怎么写!请各位大侠解释一下,谢谢!!
sql="insert into message set name='"+name+"',email='"+email+"',date='"+time+"',subject='"+subject+"',memeo='"+memo"'";源代码如下:
<%@ page contentType="text/html; charset=gb2312" language="java" import="java.sql.*" errorPage="" %>
<%@page import="java.util.*"%>
<%@include file="conn.jsp"%>
<%@include file="convert.jsp"%><%
String name,email,date,subject,memo;
name=request.getParameter("name");
email=request.getParameter("email");
subject=request.getParameter("subject");
memo=request.getParameter("memo");
int year,month,day,hour,minute,second;
String time,sql;
GregorianCalendar calendar;
calendar=new GregorianCalendar();
year=calendar.get(Calendar.YEAR);
month=calendar.get(Calendar.MONTH)+1;
day=calendar.get(Calendar.DAY_OF_MONTH);
hour=calendar.get(Calendar.HOUR_OF_DAY);
minute=calendar.get(Calendar.MINUTE);
second=calendar.get(Calendar.SECOND);time=year+"年"+month+"月"+day+"日"+hour+":"+minute+":"+second;
name=convert(name);
email=convert(email);
subject=convert(subject);
memo=convert(memo);
time=convert(time);
sql="insert into message set name='"+name+"',email='"+email+"',date='"+time+"',subject='"+subject+"',memeo='"+memo"'";Connection con=DriverManager.getConnection(url,user,password);
Statement smt=con.createStatement();smt.executeUpdate(sql);
%>