Sanitisation function: any holes? I've come up with this small function to make user submitted strings safe for MySQL. I'd be grateful if someone could point out any security holes in this. I've tested it out, and it happily replaces quotes and the like. The only issue I can see is the lack of escaping ampersands, but this shouldn't matter right?

$keywords = array("delete from", "drop table", ";", "=");
$safeKeywords = array("delete&amp;nbsp;from", "drop&amp;nbsp;table", "&amp;#59;", "&amp;#61;");

function dbSanitise($field)
{
    global $keywords, $safeKeywords;

    $sanitised = str_ireplace($keywords, $safeKeywords, $field);
    $sanitised = htmlentities($sanitised, ENT_QUOTES);
    $sanitised = mysql_real_escape_string($sanitised);

    return $sanitised;
}


Putting this string into the function above:

Hello world delete from DELETE FROM ; = " ' ''

Yields this:

Hello world delete&amp;amp;nbsp&amp;amp;#59;from delete&amp;amp;nbsp&amp;amp;#59;from &amp;amp;#59; &amp;amp;#61; &amp;quot; &amp;#039; &amp;#039;&amp;#039;

Which I can only see as being perfectly acceptable for a MySQL insert operation.

If I'm wrong, do let me know! Thanks for any help.
You shouldn't try to think of all the bad things that could be in the query, you'll never think of them all.

As it stands, your replacement is useless (as some of your commentors have noted). You can have any text you want inside of the string, its characters which might cause the string to be escaped which are a problem. 

mysql_real_escape_string does everything you need. You don't need to implement your own function. Better yet use prepared statements.