Thanks to a suggestion from @furas, I finally spotted the bad character. The corrected line is
sql = sql + "first_query." + stat_field + " = second_query." + stat_field + " "