"Best Practice" - lots of them - primarily checking each form processing script to ensure that one cannot simply pass in a long field and/or content which has sql commands such as "select", "update", etc.
As you can see from this particular situation, the data may not be readily seen as offending (ie, the binary encoding). Testing length is therefore pretty important as a rule. If you are expecting to insert a product code into a shopping cart or an email address into a registration table, there is no reason to allow a string longer than the field length to be submitted to the database. One could argue that because of that, keep your field lengths to the minimum, etc.
Minimize the number of dynamic sql statements
Keep in mind that just limiting your form field's "maxlength" property does little value as these attacks are not validated by any server side browser - they are launched via script or program and often at a very rapid pace.
If your db connection for your site is using "sa" or equivalent, you also have a problem because they can launch extended stored procs. Make sure your db connection is using "user" level privileges only.
these are some of the bigger items - there is lots on the net on the topic of 'sql injection'