So you're just giving public access for anyone to lookup any table by any field? why not just pass DQL as parameter?