How so? The function does what it's supposed to do. Of course you still have to write the rest of the SQL statement to make use of the escaped input - put all params in quotes (or much better: use prepared statements to begin with).
This would be a perfect example of why SQL injections are so common: toolchains aren't secure (or even securish) by default -- and it isn't clear that this is the case.
Anyone not using prepared statements in 2013 is just being stupid - there is no reason to ever be vulnerable to a SQL injection, barring a bug in the database or driver you are using. It's totally unacceptable.
it is when used correctly within quotes (and used with common charsets, but that's a different story altogether). There is no publicly known way to inject the following when the database is encoded in ISO-8859-1 or UTF-8:
"SELECT ... WHERE `field_name` = '" . mysql_real_escape_string($string_value) . "'";
