With respect, most junior programmers, whether self respecting or otherwise, would have trouble even recognizing that there is a need to cover some of those cases I mentioned, let alone successfully accommodating them.
Most likely you'll get a
return "'" + replace(str, "'", "\\'") + "'"
which only after the first bug report gets turned into a
return "'" + replace(replace(str,"\\","\\\\"),"'","\\'") + "'"
and that will have been arrived at after a lot of trial and error and incorrect numbers of backslashes.
And if you think that is robust, you're likely in for a surprise when someone sends you some unicode data.