Can't you use parameter substitution with "_id = ?" instead? Building queries this way is discouraged since it is unsafe in the general case.