Please try Corion's second suggestion to use placeholders. The query as it is currently written uses variables in the actual statement, which is known as dynamic sql. Amongst the many issues with dynamic sql is that it is not secure. Using placeholders will make it secure, and can end up helping with other issues as well.