SQL & PL/SQL

The following is a query that is contained in a stored procedure. The value p_last_name is passed to the stored procedure. It is a VARCHAR2(40) value that may be input by a user via a web interface. To what extent is this query vulnerable to SQL injection? Is there a preferred way to code a query like this to minimize SQL injection -- for example, making the 'FUZZY({' || p_last_name || '},,, WEIGHT)' string a bind value?

Thanks

SELECT first_name,
last_name,
SCORE(1) AS score
FROM student
WHERE CONTAINS(last_name, 'FUZZY({' || p_last_name || '},,, WEIGHT)', 1) > 0
ORDER BY
SCORE(1) DESC,
last_name;