I saw some similar question, none about mysql...  

Is there any way to do a sql injection into a SP? 
How do I protect from this on the SP level?  

In other words, can the Query strucutre, inside a SP can be modified in any way by an incoming parameter?  

If I send to a stored procedure the parameter "1;DELETE FROM users;--"
and the query is: 

```
select *
from T
where = @p

```