Use backslash (\) for string escape. See the following examples:
var sAttribute = "test";
var xCollection= Me.getXPath("entity-list(\"mEntity\", \"sAttribute = '"+ sAttribute +"' AND bActive = 1\")");
var xCollection= Me.getXPath("entity-list('mEntity','sAttribute = \"test\" ')");