They aren't using instructions to users to block SQL Injection. They're using a web application firewall to block SQL Injection, and they have it configured to take a shotgun approach to filtering form fields.

You could do the same thing with any application, secure or not, by applying a naive mod_security configuration to your Apache server.

That's not a great practice, but it doesn't tell you anything about how susceptible they are to SQLI.