How does one make the following psql statement sql-injection resilient?

["David G. Johnston" <david.g.johnston@xxxxxxxxx>]

psql "$SERVICE" \

     --echo-queries \

     --set=string_input="${1:-ok_to_return}" \

     --set=start="${2:-5}" \

     --set=end="${3:-10}" \

<<'SQL'

    SELECT idx

        FROM generate_series(1, 20) gs (idx)

        WHERE 'short-circuit' != :'string_input'

        AND idx BETWEEN :start AND :end;

SQL

# (6 rows)

--set=end="${3:-10 AND false}"

# (0 rows)

Am I forced to represent the input as text (using :'end') and then perform a conversion to integer?

Thanks!

David J.