php - Is using is_string() a good defense against SQL Injection?

I was trying to look for mitigation of SQL Injection against my web application based on PHP and MySQL. The first rule is to sanitize the query; Hence I am using mysql_real_escape_string() function for that

Here is what my snippet looks like

if (is_string($string)) {
    return $mysqli->real_escape_string($string);
} else {
    return "";
}

Here, $string would contain the user-input. After this filtering and escaping, I would use INSERT INTO query to insert into database.

This filter, will thwart any malicious user inputs like haha' , inj'' etc as is_string() will detect those string and apply real_escape_string() to escape those evil characters. The only possibility I can think an attacker can do is use a Numeric payload for SQL Injection but I don't know any Numeric payload itself has caused Injection yet so far.

So, will this filter keep away the bad guys or is it bypassable ?

EDIT:
I know Prepared statements are much better and a good coding practice while launching app in production. But for this question, I am specifically looking answer to how anyone can thwart this filter itself because it does seem strong to me!