Oracle Database Discussions

I have the following query:
CREATE PROCEDURE search (results OUT SYS_REFCURSOR, filter INT VARCHAR2)
IS
BEGIN
SELECT * FROM table WHERE CONTAINS(column, filter, 1) > 0
END

I call the above stored procedure using ODP.NET and pass the filter parameter:
parameter.Name = "filter";
parameter.Value = "'FUZZY({" + userInput + "}, 65, 6, weight)*1'";

Note that the it passes anything the user enters. Is it possible for the user to sql inject in this case?

My guess is that the filter is evaluated inside the CONTAINS operator as a search keyword regardless if the filter itself contained malicious sql.