Sanitisation function: any holes?
You shouldn't try to think of all the bad things that could be in the query, you'll never think of them all.

As it stands, your replacement is useless (as some of your commentors have noted). You can have any text you want inside of the string, its characters which might cause the string to be escaped which are a problem. 

mysql_real_escape_string does everything you need. You don't need to implement your own function. Better yet use prepared statements.