An LDAP search filter built with string concatenation permits LDAP injection.
Escape LDAP special characters or use parameterized search with encoded filter values.