Is this SP safe to SQL Injection?
All your stored procedure is doing is to put “select” in front of whatever is passed in. It doesn’t run anything.
But presumably you’re going to then ask something else to run whatever comes back, and that could be unsafe. If you’re wanting a very dynamic querying environment, then read what Erland Sommarskog has to say on the matter at http://www.sommarskog.se/dynamic_sql.html