SQL Injection Attacks

[pc_guy]

I am currently working on a PHP/mySQL based website and wanted to get some feedback if I'm doing it correctly.

There are a few sections that use GET to pass info, including category id's and names to another page, then its searched it in the database.

I am using:

mysql_real_escape_string($categoryid);

Is this enough to prevent injection attacks?

I have tried the classic OR 1=1 with:

example sql:
Select * FROM sometable id = ".$categoryid

result would be:
Select * FROM sometable id = 5 OR 1=1

This failed, and returned all rows

By adding single quotes around the inserted variable:

Select * FROM sometable id = '".$categoryid."'"

It works, even though I'm not used to putting quotes around numbers.

Has anyone used mysql_real_escape_string in the past and is it enough?