He does not want to tokenize the string, he want to replace occurences of one character with other. There's no point in doing it in an unwieldy and inefficient way.

On most operating systems the current string, as defined, wil be const. That is, he will not be able to write to it. This will require copying the string, while replacing the characters on the fly. The terminating zero is already there, it just needs to be included in the copy.