clean query to allow _id strings