LDAP injection is similar in spirit to SQL injection because they both come from the same error: missing input sanitization! When user input is passed straight into an LDAP query without proper sanitization, then the user can make their own modifications to the query being made, and introduce their own logic!