Seen plenty of sql injection through SP's (i'm a pen tester and software security head btw), either the dev's build the SP call dynamically or in some cases, i've seen dynamic sql constructed within the SP!
Best approach is (as stated already) parameterised queries, and also _in all cases_ input should be validated against expected data type (at least) and usually one or more of length, format and range.
cheers
