You can just bypass the injection risk entirely by hardcoding the values as this example demonstrates:

https://news.ycombinator.com/item?id=40246089

(I'm being sarcastic, obviously. You are 100% right)