You can use a SQL Stored Procedure to handle this.
You just set up on the SQL Server side, a procedure that takes a value (the value you expect in that form field) and then does the normal SQL query to get all the columns (or if you want, you can use a more distinct query since this is all done on the SQL side of things).
Then, you update the data source connection so it sees the new stored procedure and you use that in setting up the lookup.
You should look at the Help documentation if you need assistance in using this type of solution:
http://www.laserfiche.com/support/webhelp/laserficheforms/9.1/en-us/forms/#LookupRules.htm
EDIT:
Please note, that if sensitive information were originally available in that suggestion, your original solution of using Javascript is just smoke and mirrors that can be gotten around. The SQL Stored Procedure solution never gives out information until a valid input is given, which is a bit more secure. Please note, stored procedures were not really supported in the first version of LF Forms. You will need the 9.1 version instead.