清理 LDAP_bind 查询
我知道当我从用户输入的数据中用 PHP 查询 MySQL 数据库时，应该对数据进行清理。对于我正在启动的项目，我将使用 ldap_bind() 函数针对 Active Directory 进行身份验证以使用登录。
我已采取措施检查密码以防止匿名绑定尝试，但我想知道是否需要采取任何其他预防措施，就像使用用户输入的数据时通常采取的那样。或者这是 Active Directory 会自行处理的事情吗？
I know that when I query a MySQL database in PHP from user entered data, the data should be sanitized. For a project that I am starting up, I will be authenticating against Active Directory for use login using the ldap_bind() function.
I've taken steps to check for a password to prevent an anonymous bind attempt, but I'm wondering if I need to take any other precautions like I would normally take when using user entered data. Or is this something that Active Directory will take care of itself?
如果你对这篇内容有疑问，欢迎到本站社区发帖提问 参与讨论，获取更多帮助，或者扫码二维码加入 Web 技术交流群。
绑定邮箱获取回复消息
由于您还没有绑定你的真实邮箱，如果其他用户或者作者回复了您的评论，将不能在第一时间通知您！
发布评论
评论（2）
我是一个 OpenLDAP 类型的人，但如果我没记错的话，没有办法用特殊字符来利用它。
但是，这并不意味着删除您知道不会存在的内容不是一个好习惯，特别是在用户名或生成的绑定路径中。例如：
$myname = preg_replace( "/[^a-zA-Z0-9_\ -]/", "", $myname );
这将删除除小写、大写、数字、下划线、空格和破折号之外的所有内容。使用“仅允许此”逻辑总是比“拒绝某些内容”更安全。你永远不可能想到所有要拒绝的事情。
I'm an OpenLDAP kind of guy, but if I'm not mistaken there's no way to exploit this with special characters.
However, that doesn't mean it's not good practice to strip out things you know won't be there, particularly in user names or generated bind paths. For instance:
$myname = preg_replace( "/[^a-zA-Z0-9_\ -]/", "", $myname );
That would strip everything out except lowercase, uppercase, numbers, underscore, spaces and dash. It's always more secure to use an "allow only this" logic rather than "reject something". You can never think of ALL things to reject.
请小心验证密码不为空。听起来很愚蠢，但根据 LDAP 标准，使用用户名且没有密码的绑定将被视为匿名绑定并且会成功。
如果您使用绑定尝试的成功/失败来验证用户凭据，那么空密码将是伪造它的好方法。
Be careful to validate that the password is not null. Sounds silly, but according to the LDAP standard a bind with a username and no password is counted as an anonymous bind and will succeed.
If you are using the success/failure of the bind attempt to validate the users credentials then a null password would be a nice way to fake it out.