you can only escape javascript-quotes, whether they're single or double. But you just can't escape HTML-quotes.
So if you need single quotes in your string in a HTML-attribute, use double quotes for HTML:
<A HREF="javascript:;" ONCLICK="alert('Now I can escape this: \' you see?'">Click here</A>
But if you need double quotes in your string in a HTML-attribute, use single quotes for HTML:
<A HREF='javascript:;' ONCLICK='alert("Now I can escape this: \" you see?"'>Click here</A>
Ofcourse the real problem occures when you need both. Some suggestions:
1. You don't use quotes for your HTML-attributes at all. Though I'm sure w3-people won't like you for this, maybe it'll work. On the other hand, this might mean that the browser ends the reading of the attributes value at the next space. I'm not sure it does because I've seen something like this work:
<font face=comic sans ms size=12>No quotes in my HTML</font>
2. You put the values that contain quotes in a var, somewhere in javascript where you don't have to think about HTML-quotes at all.
<script type="text/javascript">
var myvar='This string contains both single quotes: \' and double quotes: " neat isn\'t it?';
</script>
<a href="javascript:;" ONCLICK="alert(myvar);">Click here</a>
3. You use HTML-codes for characters, like & quot ; (without the spaces obviously). This will work depending on what you're going to do with it. If you're gonna display this in an alert like my examples it won't work. But since you're talking about a function createPopup you're probebly gonna display it as HTML and than it will work.
@mods or those fortunate with a higher rank: It's a pain in the ass that the \ followed by a ' is replaced with just a ' in regular text and between FONT=courier new, PHP or CODE vB-codes (yes, I've tried them all) since this is something you might wanna use in your reply. Not that I blame you, I understand why, but surely you can program phpBB to replace a \ with a & # 92 ; without the spaces like I did by myself?
2nd @mods etc.: the & # 92 ; stays & # 92 ; in between PHP vB-codes and probebly in between code-codes. This is why I use FONT=courier new which replaces javascript with java script.