# after you've fetched the row

my $escapedCustno = jsescape($custno);
...
print <<EndHTML;
<script language="javascript">
fillCustomer('$escapedCustno', ...

sub jsescape {
    my $str = shift;
    $str =~ s/("')/\\$1/g;
    $str;
}