0

I inherited a PHP application which has a login form. The login is performed against an LDAP server. The original programmer wrote this line to perform the bind:

 $r = ldap_bind($ldap_connection, $bind_dn, $ldap_passwd);

It seems simple enough, however when a user has an apostrophe in their password, the login fails. Should the the $ldap_passwd variable be escaped somehow? I googled it a bit and found myriad ways to escape a PHP string but many of these had to do with MySQL queries, and for just as many questions, there were replies about "dear god, don't do it that way" or "that has been deprecated" so not exactly sure what the best way to approach this is. The PHP.net page (https://www.php.net/manual/en/function.ldap-bind.php) doesn't suggest there should be a need for any escaping but not sure how to approach testing this.

4
  • APIs usually don't require you to escape data, it's only necessary when you're building query strings dynamically, as you found with SQL queries.
    – Barmar
    May 14, 2020 at 21:20
  • Generally, no, but this smells like it could be a bad implementation on the LDAP side. Check your LDAP service provider's documentation.
    – Sammitch
    May 14, 2020 at 23:21
  • I don't think it's the LDAP server. I worked with the user yesterday to troubleshoot. They are able to sudo at the Linux command line just fine and logging into a Rails app works fine too. It's seems to be something specific with PHP or this particular appliation/implementation. If escaping the password isn't common practice, I'll have to dig in further.
    – Nstevens
    May 15, 2020 at 13:33
  • The password is being retrieved from the $_POST['pass'] variable specified on the login form. Something appears to be changing any " ' or \ character in the password with an escaped version of that character. My guess is this is some bizarre PHP thing but still looking into it.
    – Nstevens
    May 15, 2020 at 17:06

1 Answer 1

0

PHP is escaping the input due to magic_quotes being enabled either on the server or at the application level (Wordpress instance). Seems to be fixed for now using stripslashes(). Leaving it here in case anyone else runs across it.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.