REPLACE string function is blacklisted

[baragona]

But really only the REPLACE statement should be blacklisted, the string function is totally unrelated and is safe.

[Chris Clark]

See the answer to #371

Kinda annoying but easy to work around by overriding the setting :)