SQL injections sanitization

There is a developer that is ostinated to say that he has developed a function that sanitize any input from SQL injection. this is the method he has done:

public static string SanitizeInput(string sqlString, bool addQuotes)
{
    string output= "";
    if (addQuotes)
        output= sqlString.Replace("'", "''");
    else
        output= val;
    if (output== "")
        output= "NULL";
    else if (addQuotes)
        output= "'" + output+ "'";
    return output;
}

and it's used like the following:

string sqlCmd = string.Format("EXEC myStoredProc @paramX={0}",Utils.SanitizeInput(sqlInputFromUser,true));

DataTable dt = new DataTable();

using (SqlConnection sqlConn = new SqlConnection())
{
    sqlConn.ConnectionString = ConfigurationManager.ConnectionStrings[ConnectionString].ToString();
    sqlConn.Open();
    SqlCommand cmd = new SqlCommand(sqlCmd, sqlConn);
    SqlDataAdapter sda = new SqlDataAdapter(cmd);
    sda.Fill(dt);
}

Am I correct to say that this is, in any case, a bad practice because there is no way of foreseeing what the users will pass as parameters and they can find a way to break it and inject malicious SQL code?

**** EDIT: Additional infos ****

Some additional replies from the developers that maybe be worth mentioning:

1. The Azure WAF does not allow anything SQL related including punctuation marks
2. All SQL that involves user input is queried from the database using strongly typed stored procedures
3. All user input is sanitized by a function

Points No. 2 and 3 are wrong, as already discussed in the comments. I could just add a string like "'; DROP database ..." to bypass his sanitization and strong typed stored procedures

But regarding point 1, is it possible that there is an Azure WAF that block on a web page (it's an MVC web application) if the user inputs a string like the one above where I've put a ";" to break the query?