title: Is this stored procedure safe from SQL injection?
body: <p>Stored procedure is as follows:</p>
  
  <pre><code>CREATE PROCEDURE Foo
      @bar varchar(100)
  AS
  
  SELECT * FROM tablename
  WHERE columnname LIKE '%' + @bar + '%'
  </code></pre>
  
  <p>I've tried passing various strings to this stored procedure, but to me it looks like this would be safe from a SQL injection since everything between and including the wildcards would result in a single string.</p>