QDBM and GDBM appear to be the only DBA handlers that will allow dba_replace to work correctly.  The DBA Handlers must be compiled or built into the version you are using.  See dba_handlers (http://www.php.net/manual/en/function.dba-handlers.php) for more specific information:

Also when you search online you will see mention of “security” related issue, supposedly, related to the dba_replace() function.  In every instance of the “security” issue documented online, the dba_open function specified the DBA handler option of “inifile”.  DBA handler “inifile” is intended for the management of ini files specifically.  Here are the dba_open and dba_replace code snippets related to this “security” issue:   

<?php
$source=dba_open("/www/about.ini", "wlt", "inifile");
dba_replace("HOME","/www/",$source);
?>

I have also seen errors listed online with DB4 and use of the dba_replace function.  Though I am skeptical of those reports.  Unfortunately I do not have a database with the DB4 handlers compiled in to check if there is an issue with dba_replace and the DB4 DBA handler or not.  At least you are aware that there may be an issue and can check if need be.

Assuming the correct DBA handlers are “built” or compiled into your database when built for the packages you are using, there is probably not an issue with dba_replace() and actual database files.  If you experience a problem with dba_replace() make sure you build in DBA handlers QDBM or GDBM.

You can not build in both QDBM and GDBM together in the same build, however you probably can build in both INIFILE and FLATFILE with either QDBM or GDBM.  It is unclear if you can build in either db3 or db4 with QDBM or GDBM.  It appears that DB4, CDB, INIFILE and FLATFILE are often built together.

see User contributed notes for dba_handlers() and dba_open() related to CDB.