$content=str_replace(":","_",$content);
*cringe*
That's probably not good enough. URL encoding, malformed UTF-8 characters, relative paths to other webspaces on the same server, just to name a few more things to worry about. There's way more if you're sending user input to the shell, to an open() function, or to another user's browser (XSS.)
Unless you're willing to sit down and try everything yourself (or throw caution to the wind and hope no one tries to hack you) the switch is your best friend. If a little bit of hardcoding keeps your server secure, hey: do it.