Is using is_string() a good defense against SQL Injection? [duplicate] - php

Question

This question already has answers here:
Can I protect against SQL injection by escaping single-quote and surrounding user input with single-quotes?
(19 answers)
How can I prevent SQL injection in PHP?
(27 answers)
SQL injection that gets around mysql_real_escape_string()
(4 answers)
Closed 4 years ago.
I was trying to look for mitigation of SQL Injection against my web application based on PHP and MySQL. The first rule is to sanitize the query; Hence I am using mysql_real_escape_string() function for that
Here is what my snippet looks like
if (is_string($string)) {
return $mysqli->real_escape_string($string);
} else {
return "";
}
Here, $string would contain the user-input. After this filtering and escaping, I would use INSERT INTO query to insert into database.
This filter, will thwart any malicious user inputs like haha' , inj'' etc as is_string() will detect those string and apply real_escape_string() to escape those evil characters. The only possibility I can think an attacker can do is use a Numeric payload for SQL Injection but I don't know any Numeric payload itself has caused Injection yet so far.
So, will this filter keep away the bad guys or is it bypassable ?
EDIT:
I know Prepared statements are much better and a good coding practice while launching app in production. But for this question, I am specifically looking answer to how anyone can thwart this filter itself because it does seem strong to me!

Answer 1

NO
is_string() will not protect against SQL injection, a numeric payload will not be able to cause any table damage or unwanted access regardless, and string sanitization does not protect against all SQL injection.
I should give you the spiel about why prepared statements are amazing and all that, but you yourself indicated that the point of the question was to point out flaws in sanitization
Why You Should Use Prepared Statements Over Sanitization
There are situations where you want unsanitized data in your database, e.g. specially formatted text (like LaTeX, XML, or JSON), where you would need to de-sanitize data, which is not a 100% guarantee of accuracy (e.g. XML file which includes HTML entities like " would be changed to ", changing the data)
Prepared statements can be re-bound and executed in very few lines
Theoretically, if you have a query like the one below, sanitization will not save you(borrowed from here)
$iId = mysql_real_escape_string("1 OR 1=1");
$sSql = "SELECT * FROM table WHERE id = $iId";

Answer 2

NO: PHP delusion #1: Mysql(i)_real_escape_string prevents SQL injection
This filter, will thwart any malicious user inputs like haha' , inj''
Your ideas are anything but a protection. There is nothing "malicious" in user inputs like haha' , inj'', neither a really malicious input would contain any of these characters.
That said, any user input is a string, so you will create a mockery of the notorious magic quotes feature, much despised and long removed from the language.
Go for the prepared statements.