i found a few examples online on how to import excel into sql via vb. but can i do it via stored procedure?

```
Insert into SQLServerTable Select * FROM OPENROWSET('Microsoft.Jet.OLEDB.4.0', 
    'Excel 8.0;Database=D:\testing.xls;HDR=YES', 
    'SELECT * FROM [SheetName$]')

```

so like, can i pass in: 

```
('Microsoft.Jet.OLEDB.4.0', 
        'Excel 8.0;Database=D:\testing.xls;HDR=YES', 
        'SELECT * FROM [SheetName$]')

```

as a parameter to SQL Server SP? or how else can i protect myself from sql injections and other attacks?