You don't really *replace* it anywhere. You simply have two strings or arrays, one that tracks the actual word, and one that tracks the guessed word. You go through the actual word with the letter chosen, and when it finds a match in the original word, it replaces the same chars in the guessed string. This is why I'd use a char since its just that much easier.
As for the actual code you have here, you'll need to rework that. There are a lot of errors here and you seem to be missing a lot of operators.
header('HTTP/1.1 420 Enhance Your Calm');