bug in building the sql query when using composite primary keys