It may be enough, and it may not be, but it is definitely not a good idea.
Can a hacker still get away with a XSS?
Possibly, depending on the situation.
@BenoitEsnard already described one situation where filtering out
> is not enough: When the user input is echoed inside attributes of existing HTML tags, because then an attacker could just add new attributes themselves.
Here is a list with different contexts and how to handle them when preventing XSS.
Is there any reason not to do this?
Lets assume that you really only echo the comment inside
<textarea>COMMENT</textarea> when editing a comment, and inside
<div id=comment>COMMENT</div> when showing a comment, nowhere else, and you don't want any HTML formatting at all, just plain text as you said.
If you write your function correctly, it would be secure. But it wouldn't be very user friendly. Depending on the kind of website you have, users would want to use
> in many situations, eg:
Love you <3,
2 < 3,
use this: this->exec(),
<font> is deprecated,
So it is definitely a usability issue, and possibly a security issue depending on context and correctness of implementation.
Just use the functions which are commonly used instead of writing your own mechanism (eg in PHP use htmlentities when echoing user input in a HTML context where you do not want to parse given HTML, use some library such as HTMLPurifier if you do need HTML, and so on)