Look here for a possible answer to this question.
http://dba.stackexchange.com/questions/73931/prevent-sql-injection-inside-stored-procedurehttps://dba.stackexchange.com/questions/73931/prevent-sql-injection-inside-stored-procedure
But the answer there is also a follow-up question.