php - 如何防止 LDAP 注入(inject)

Question

我们正在构建一个通过 php 使用 LDAP 的应用程序，我开始思考是否可以通过注入(inject) LDAP 来做任何事情，更好的是如何防止 LDAP 注入(inject)？

Answer 1

构建 LDAP 过滤器时，您必须确保根据 RFC2254 处理过滤器值:

Any control characters with an ACII code < 32 as well as the characters with special meaning in LDAP filters "*", "(", ")", and "\" (the backslash) are converted into the representation of a backslash followed by two hex digits representing the hexadecimal value of the character.

Zend_Ldap 例如使用以下例程

//[...]
$val = str_replace(array('\\', '*', '(', ')'), array('\5c', '\2a', '\28', '\29'), $val);
for ($i = 0; $i<strlen($val); $i++) {
    $char = substr($val, $i, 1);
    if (ord($char)<32) {
        $hex = dechex(ord($char));
        if (strlen($hex) == 1) $hex = '0' . $hex;
        $val = str_replace($char, '\\' . $hex, $val);
    }
}
//[...]