SQL Server :: For Loop Giving An Error While Inserting A Data?

I'm having some problems with the interface I've created. I am getting value and ids in a string using for loop on the controls(objects). After some searching, I've discovered that it isinserting an empty string into my database fields as opposed
to an null value. I need my application to insert NULL values, not emptry strings. Can any one suggest me on this and also how can i prevent sql injection on the above code. because i am passing like following :

@variable1='Name,Address,Remarks' //(as a Column name)
@variable2='Pritesh,Mumbai,any remark' //(as a column value for above.)
exec myprocedure 'tablename','@variable1','@variable2'.

if any one pass single inverted comma in the above column value in @variable2. my code give me error. how can i prevent this sql injections..