XSS prevention is all about context. You need different strategies depending on what context the untrusted data you are escaping will be inserted into.
While I think your method would be fine inside HTML elements and in HTML attributes in double quotes, you would have problems in the following contexts:
- In HTML attributes with single quotes or without quotes at all, you will be pwned.
- In e.g. a
href attribute, you would be pwned with e.g. a
- And then there's CSS, which has it's own set of different rules...
For a detailed guide on how to do this right, I strongly recommend the OWASP XSS prevention cheat sheet. I think the main take home lessons of all this is: XSS is complicated. Don't rely on your own home brewed solution to stop it. Use a well tested library instead.
(And Alexander O'Mara is absolutely right in his comment. If this is in the browser, just go with