Is this code in a stored procedure sql-injectible

If I have a where clause in a stored procedure that concatenates a search string that comes from the front end (user supplied) ... like this:

FirstName like '%'+@SearchString+'%'

Can this me injected with malicious code?