I’m really hesitant to comment, because I think it’s a significant security risk to attempt what is being attempted here in the first place.
So I really hope that anybody reading this will take that to heart and come up with a safer and more idiomatic way of dealing with things.
That being said, read this. There is a difference between binding and interpolation when non-strings are involved, and it affects sanitization.