SQLite3 doesn't have stored procedures that run in the RDMS but to @Dan's point of avoiding SQL injection it does prepare statements, and it supports binding values to those prepared statements.