I sincerely hope that that ArangoDB handles bind variables correctly. So if you use them, you should indeed be safe, right?