t-SQL stored proceedure security

Hi,

What would be a bad implementation of security when it comes to Stored Procedure code?

Is it possible for someone to send a malicious string into a parameter and have malicious code executed?

hermanSmiles