Does putting single quotation marks around numeric constants really protect from SQL injection in MySQL?
Short answer, no.  The quoting trick is easily defeated by including your own closing quote and then a comment symbol to eliminate the final concatenated quote, precisely as in your example.

To protect yourself from SQL injection you must use bind variables.  Changing your example to SELECT * FROM table WHERE ID = :X and then binding the user's input to X solves the problem instantly and completely.  It is impossible to over-emphasize how important this practice is!