declare @vbCrLf CHAR(2)
SET @vbCrLf=CHAR(13) + CHAR(10)
SELECT 
   max(s3.create_date) AS create_date,
   s3.name As [TheTable],'UPDATE ' + s3.name + ' SET ' + 
   stuff((    SELECT ',' + name  + ' = REPLACE(' + name + ',''badstring'',''goodstring)' + @vbCrLf
              FROM sys.columns s2
              WHERE OBJECT_NAME(s2.object_id)= s3.name   --- must match GROUP BY below
              and TYPE_NAME(s2.system_type_id) = 'varchar'
              ORDER BY s2.column_id
              FOR XML PATH('')
          ),1,1,'')  as [TheColumns]
FROM sys.columns s1
inner join sys.objects s3 on s1.object_id = s3.object_id
WHERE s3.type='U'
GROUP BY s3.name --- without GROUP BY multiple rows are returned
ORDER BY s3.name