You can by creating the stored procedure with two params and use CALL yourprocedure(param1, param2).
Apart from that I advise to use MySQLi or PDO using bound parameters. If you insert table names like that be sure to do strict validations before using them. Using backticks around your table and columns names too.
Stored procedures rarely have to do with security and certainly not in your example. Of course you should use prepared statements along with PDO for example but you should validate data both client side and server side. Creating a stored procedure for a single statement doesn’t make any sense other than hiding it from you.
Could you give me example (on that simple query) how to make it secure client/server side? Thank you