I inherited a PHP application which has a login form. The login is performed against an LDAP server. The original programmer wrote this line to perform the bind:
$r = ldap_bind($ldap_connection, $bind_dn, $ldap_passwd);
It seems simple enough, however when a user has an apostrophe in their password, the login fails. Should the the $ldap_passwd
variable be escaped somehow? I googled it a bit and found myriad ways to escape a PHP string but many of these had to do with MySQL queries, and for just as many questions, there were replies about "dear god, don't do it that way" or "that has been deprecated" so not exactly sure what the best way to approach this is. The PHP.net page (https://www.php.net/manual/en/function.ldap-bind.php) doesn't suggest there should be a need for any escaping but not sure how to approach testing this.
sudo
at the Linux command line just fine and logging into a Rails app works fine too. It's seems to be something specific with PHP or this particular appliation/implementation. If escaping the password isn't common practice, I'll have to dig in further.$_POST['pass']
variable specified on the login form. Something appears to be changing any " ' or \ character in the password with an escaped version of that character. My guess is this is some bizarre PHP thing but still looking into it.