Stored procedure is as follows:

```
CREATE PROCEDURE Foo
    @bar varchar(100)
AS

SELECT * FROM tablename
WHERE columnname LIKE '%' + @bar + '%'

```

I've tried passing various strings to this stored procedure, but to me it looks like this would be safe from a SQL injection since everything between and including the wildcards would result in a single string.