SQL injection works by skipping out from the "value" part of SQL syntax into the "command" part.
String values (as in your example) are surrounded by quotes - to break out you would need to include a similar quote in your value (like ' WHERE 1; DROP TABLE ...
or whatever the actual syntax would be). HTML encoding doesn't allow quotes, so that won't work.
I did wonder a bit about unquoted fields - e.g. if it's expecting a number (from a dropdown) but you give it a command (like 5 WHERE 1; DROP TABLE ...
or whatever). However, I'm not aware of any single-word SQL statements - i.e. you can't do anything without something to separate the tokens (e.g. a space
or punctuation (
etc.). So even if you were looking at an unquoted field like a number then you could screw up the statement and produce an error, but not actually execute anything.