PHP : LDAP manipulation

LDAP query injection is possible. The application executes the LDAP query containing data from an untrusted source. This can lead to data confidentiality loss or to its modification.

LDAP is an application-level protocol for accessing the X.500 directory service. If LDAP query is based on data from an untrusted source (e.g., user input) and the data does not pass validation, an attacker can modify the query and execute it with the application rights or even execute an arbitrary LDAP query.