From that point of view you shouldn't use a computer at all.
Your logic never fails to astound me.
I agree, replacing ":" my be not enough, you also have to replace ".." and some other tiny bits. But with a hand full of lines of code it will be pretty save.
How will you know when you have enough code?
Have you tried a double URL encoded "%203A"? Have you tried encoding a ":" as more than one byte with UTF-8? Have you tried breaking apart that multi-byte ":" with malformed UTF-8 characters? How about a null byte at the beginning of the string? Any of these things might be able to slip a ":" that include() will honour past your string replacement.
I'm not a hacker and I thought of some things that might work that you didn't. A real hacker with time on his hands might think of more. A real hacker with time and access to sources might think of more still. It doesn't matter if the things I thought of work or not, the point is that it's unlikely that you'll catch all the cases.
I've worked on a cross-site scripting filter, and I can tell you that there are some remarkably complex and weird ways that you can get IE to execute javascript even after removing all the obvious tags and attributes.
The easiest way to solve tainted input problems safely is to make a list (programmitically or hardcoded) of acceptable input; even if you just have a list of accepted characters. The hard way is to modify the input string and test every conceivable exploit, then hope that no one thinks of any that you didn't.
P.S. This is hillarious. You're now taking the complete opposite stance from the one you took in our last discussion. Previously, you wanted to have complete control over everything your computer does and never delegate tasks to other peoples' code. Now you're perfectly content to hand tainted strings off to other peoples' system calls that could compromise the security of your computer needlessly.