SQL sanitation is foolproof in the sense of it being possible to do 100% right. We don't do it much because there are other options (like prepared statements) that are easier to get 100% right.

This is an entirely different thing from trying to reduce the probability of an attack working.

The only part that isn't foolproof is remembering to do it. If you run the sanitization function, it will work.

Unless you're using a build of msyql that predates mysql_real_escape_string, because the _real version takes the connection character set into account and the previous version didn't.