If your security is based on "in my application common use case X will never happen", it will likely fail.
First of, input sanitation is not the correct approach to XSS, context dependent encoding is.
Your approach is also overly complex. Why do you filter space and
+? Why replace
_, but the others with space?
Your approach is also not very user-friendly.
> are used legitimately all the time, as is
All that being said, no, in a plain HTML context - not in a HTML attribute context, CSS or JS context, etc - XSS cannot take place without
>, so there would be no way to bypass the filter. In other contexts, XSS can still happen. Even if you don't currently put user input in other contexts, you or another developer will do so in the future. And they will just assume that a function called
tep_sanitize_string will be secure here as well.