<?php

$str = "SQL :param1 :param2 END_SQL";
$params = array (
  'param1' => 'param1 value',
  'param2' => 'param2 value'
);

echo preg_replace_callback('/:([a-z0-9]+)/', function ($m) use ($params) {
  return '\'' . mysql_escape_string($params[$m[1]]) . '\'';
}, $str) . "\n";