Escape octets inside a value
04A backslash and two hexadecimal digits encode one octet, not an entire Unicode character.
The fictional value Mira*)( is encoded as Mira\2a\29\28 inside a trusted (cn=...) wrapper. Its punctuation cannot add another filter component.
Source for this drawing: RFC 4515 · Read RFC section 3 ↗
New to this? Start hereA quick picture + helpful background
A message needs an address.
Think of a packet as a small addressed envelope. Devices pass it onward; transport protocols decide what delivery promises an application gets.
Helpful first, if these ideas are unfamiliar
These pictures are analogies to help you learn. The linked RFC explains the actual rules.
Terms in this drawing
Related RFCs and changes
“Updates” changes part of an earlier RFC. “Obsoletes” replaces it. This list shows selected related documents.
In an assertion value, NUL, (, ), *, and backslash must be represented by \00, \28, \29, \2a, and \5c. Other normal octets may also be escaped.
- In an assertion value, NUL, (, ), *, and backslash must be represented by \00, \28, \29, \2a, and \5c. Other normal octets may also be escaped.
- UTF-8 encodes a character as one or more octets. Escaping é therefore uses two octets, \c3\a9, not a single Unicode-code-point escape. The entire generated string representation is valid UTF-8.
- Generators MUST escape octets above 0x7F that are not in a valid UTF-8 sequence. Implementations SHOULD accept input strings that are not valid UTF-8 for legacy compatibility. Those are different requirements; this bounded teaching helper does not implement that server compatibility path.
- Escape a value before placing it in a fixed, trusted filter structure. Filter escaping is different from URL percent-encoding and from escaping an attribute name or an entire filter. It is not encryption or access control.
The illustration-only encoder escapes all non-ASCII octets, including valid UTF-8 octets; RFC4515 permits escaping normal octets too. It preserves bytes and is not a general filter parser or LDAP server.
Read the RFC section ↗