Support both stored procedures and functions with same TSQL code base?
Sounds like you've already made the decision to use T-SQL for your back-end.  For OWASP reasons, you are correct in that calling only stored procedures from your data access layer is the safest approach to avoid SQL injection.

Stored procedures and functions are similar in that you can pass arguments for the parameter list.  They also can do similar things.  Code re-use is a good thing and will save you in the end when fixing bugs or making enhancements in the future.  So find the logic that is similar and re-factor that code to functions.  If you want to return tables (single result set), use table based functions.  If you want to return single values, use scalar functions.  Note, you won't be able to perform permanent environment changes with functions (no CRUD operations are allowed... CREATE/INSERT, READ, UPDATE, DELETE).  It's also good practice to wrap your stored procedures with error/exception handling and return those exceptions to the server, to let your logging handle them appropriately.  Also note that it's common to return multiple result sets in a single call to a stored procedure (3 SELECT statements for example).  In your application code, you'd handle each table individually in the response.

Here are some differences: