You're mixing up your variables. When you use merge syntax in SOQL, you must use the name of an existing variable in your scope. So if you had a variable called stockId, you could use: 'WHERE Id = :stockId'. You can't do any cross-references, though, so stock.Id cannot be merged in.
However, if you use 'WHERE Id = :'' + stockId, you get a resulting query string of 'WHERE Id = :a0236000001bOXdAAM'. Since you do not have a variable called a0236000001bOXdAAM, you get an error.