No, there is no length that is too short to be exploitable (at least in some situations).
A length-filter is not a valid protection against SQL injection, and prepared statements really are the only proper defense.
A length filter is however a good measure as defense in depth (as are integer filters, alphanum filters, etc). There are many situations where e.g. valid input could never be above say 30 characters, but where meaningful exploitation requires more. It should (but probably doesn't) go without saying that any filtering as defense in depth must be taking place server-side as anything client-side can simply be bypassed.
Restriction clauses (e.g.
OR) can be bypassed by two characters, which can cause real harm, not just a failed query. The most simple example is a login (other examples would be the unauthorized deletion of additional data):
SELECT * FROM users WHERE userid = [id] AND password = [password]
id = 1#
password = wrong_password
Payload: 2 chars
DoS attacks require very few characters. In a MySQL example, it takes 7 for the actual call + x for the given seconds + whatever is needed to be able to call the function and fix the query.
SELECT * FROM users WHERE userid = [id]
Injection (this is a valid injection, a longer form would be
1 AND sleep(99)):
Payload: 9 chars
If the data is displayed, the length depends mainly on the table and column name. I'll assume equal column count for all tables (it may happen, and it saves characters).
SELECT * FROM comments WHERE commentid = [id]
1 union select * from users
Payload: 27 chars.
Unauthorized database modifications can also be achieved with few characters.
UPDATE users SET password = '[password]' WHERE id = [id]
Injection (into password):
Payload: 12 chars
A restriction bypass would also work (the result is that all passwords are now empty*):
Payload: 2 chars
* The password example is used for simplicity; passwords should be hashed making the example impossible. The example still applies in all similar situations (updating a username, updating permissions, and so on)