A DirectorySearcher filter is built by concatenating untrusted input into the LDAP query.
Escape LDAP special characters in user input before building the search filter.