filter did not use setParameter()

In old code, without using parameters, values used for filtering where not passing by Doctrine escape. So, if you had an Entity with string "id", query failed for invalid SQL (since no escape implies no quotes). Also, no escape is insecure.