Without going into the platform underneath, is there any effective way to protect a web server from SQL injection? Any special Apache module or config? Would fail2ban be appropriate here?
Apache is not subject to an SQL injection, as it is not a database.
If you want to protect an application Apache runs which in turn calls a database, you could put a WAF (Web Application Firewall) in front if it.
Another approach would be to use mod_security in Apache with a ruleset that looks for SQL in the post/gets.
Fail2ban would be of very limited use as it scans log files for signs of brute force attempts. An SQL injection would often not be visible in the logs, and even if the logs are extended so as to expose this information, they are unlikely to be of much use, as they will pick up the request after its been processed.
SQL injection is well documented. Fix your applications, not necessarily your web server.
CWE-89 categorizes SQL injection in detail. Note how mitigations like parameterization or using a decent persistence library are in the development phase. There's only so much a WAF style filter can do post deployment.
OWASP has practical resources for how to develop applications correctly avoiding SQL injection in the first place.
MITRE ATT&ACK categorizes it as a public-facing app exploit and lists software updates and application isolation among mitigations.
SQL injection should be prevented at the application (using parameterized queries, escaping user input, using stored procedures, etc). Other ways of mitigating against SQL injection would be things like Apache's mod_security or using a service like Cloudflare.
As written previously, you should tackle SQL injections on an application level. If you use out-of-the-box software like wordpress, keep it up to date. If you develop yourself, use prepared statements whenever possible and never ever trust user input.
If you really want to do some hardening, use .htaccess to forbid any URLs that contain a semicolon or two dashes. ( ; and -- ), That will catch... well, maybe 1/3 of the attacks? Don't rely on that though.
That said, you can and should harden your server as much as you can, just keep in mind that some restrictions might affect legit traffic as well. Assuming you use PHP, check Suhosin.
In the olden days we used to sanitise inputs in the application, before they got near the database. Maybe things are 'different' these days. Here's a post from 11 years ago, which has been active recently: https://stackoverflow.com/questions/129677/how-can-i-sanitize-user-input-with-php