title: Free-form queries to the database over HTTP
body: <p>I am working on providing a REST interface to some database tables.
  I want to provide the client a way to fetch data in a dynamic fashion.
  e.g.</p>
  
  <p>/customer/1234?active=true&amp;gender=M&amp;wealth>100000&amp;...</p>
  
  <p>So the idea is to have the query string as free form as possible. 
  For database access, I'd gather all the query parameters and append them to a SQL where clause and return the response.</p>
  
  <p>I am not sure if there's a key issue here that I might be missing possibly with regards to security. </p>
  
  <p>Is this a good idea? If yes, do you know of such an implementation, can you point me to it?</p>