The admin should define url-tokens (with type, for example text, number) on the form. this form will be parsed by viewing the module on a page and can be used in the sql queries to get data, before the user do his inputs.

the live form modul to security checks on the url-tokens, so ther can't be malicous code in the tokens.