How does one make the following psql statement sql-injection resilient?

psql "$SERVICE" \
--echo-queries \
--set=string_input="${1:-ok_to_return}" \
--set=start="${2:-5}" \
--set=end="${3:-10}" \
<<'SQL'
SELECT idx
FROM generate_series(1, 20) gs (idx)
WHERE 'short-circuit' != :'string_input'
AND idx BETWEEN :start AND :end;
SQL

# (6 rows)

--set=end="${3:-10 AND false}"

# (0 rows)

Am I forced to represent the input as text (using :'end') and then perform
a conversion to integer?

Thanks!

David J.