You escape quotes with backslash \
.
<a href="#" onClick="litString(\"test one\")"><h2>JS String Literal</h2></a>
Or you can use single quotes:
<a href="#" onClick="litString('test one')"><h2>JS String Literal</h2></a>
Or you can use single quotes around the attribute, and double quotes inside:
<a href="#" onClick='litString("test one")'><h2>JS String Literal</h2></a>
If you're echoing the string, it gets a little trickier, because you also have to deal with PHP's quoting. Here I produce the second version above by escaping the single quotes.
echo '<li><a href="#" title="'.$res_bb['eng'].'" onClick="loadChap('.$res_bb['id'].','.$res_bb['chapters'].',\''.$res_bb['mal'].'\')"><font size="2">'.$res_bb['mal'].'</font></a></li>';
I just tested this with input:
$res_bb = array('eng'=> "Title", 'id'=> 10, 'chapters'=> 13, 'mal'=> "Foo bar");
The output was:
<li><a href="#" title="Title" onClick="loadChap(10,13,'Foo bar')"><font size="2">Foo bar</font></a></li>