Checks whether one attribute of an entry equals a supplied value. This guide demonstrates its use in PHP code and explains when the result or side effect needs extra checks.
What It Does
Checks whether one attribute of an entry equals a supplied value.
Syntax and Parameters
The examples below show a real call to ldap_compare with suitable arguments. Read the function call in context: its connection, handle, input data or other prerequisites are created before use.
Requirements: LDAP extension; an LDAPS directory and scoped credentials.
These examples are for an isolated development environment. Hostnames, credentials and remote paths must be replaced with your approved configuration.
Example 1: Core Behavior
Bind to a controlled directory and use a restricted service identity.
<?php
$user = getenv('LDAP_BIND_DN'); $pass = getenv('LDAP_PASSWORD');
if (!$user || !$pass) throw new RuntimeException('LDAP credentials are required');
$ldap = ldap_connect('ldaps://directory.internal.test:636');
if (!$ldap) throw new RuntimeException('LDAP handle unavailable');
ldap_set_option($ldap, LDAP_OPT_PROTOCOL_VERSION, 3);
$base = 'ou=People,dc=example,dc=test';
$dn = 'cn=Demo User,ou=People,dc=example,dc=test';
$filterValue = 'Alice (QA)';
$filter = '(cn=' . ldap_escape($filterValue, '', LDAP_ESCAPE_FILTER) . ')';
if (!ldap_bind($ldap, $user, $pass)) throw new RuntimeException("Directory bind failed");
$resultValue = ldap_compare($ldap, $dn, "sn", "User");
echo is_bool($resultValue) ? ($resultValue ? "true" : "false") : json_encode($resultValue, JSON_PARTIAL_OUTPUT_ON_ERROR);
if ($resultValue === -1) throw new RuntimeException("LDAP compare error");Observe the returned value or changed resource state. A successful function call can still require additional checks before a higher-level operation is considered successful.
Example 2: Alternative or Failure Case
The second example uses a different directory record or input value.
<?php
$user = getenv('LDAP_BIND_DN'); $pass = getenv('LDAP_PASSWORD');
if (!$user || !$pass) throw new RuntimeException('LDAP credentials are required');
$ldap = ldap_connect('ldaps://directory.internal.test:636');
if (!$ldap) throw new RuntimeException('LDAP handle unavailable');
ldap_set_option($ldap, LDAP_OPT_PROTOCOL_VERSION, 3);
$base = 'ou=People,dc=example,dc=test';
$dn = 'cn=Example Staff,ou=People,dc=example,dc=test';
$filterValue = 'Alice (QA)';
$filter = '(cn=' . ldap_escape($filterValue, '', LDAP_ESCAPE_FILTER) . ')';
if (!ldap_bind($ldap, $user, $pass)) throw new RuntimeException("Directory bind failed");
$resultValue = ldap_compare($ldap, $dn, "sn", "User");
echo is_bool($resultValue) ? ($resultValue ? "true" : "false") : json_encode($resultValue, JSON_PARTIAL_OUTPUT_ON_ERROR);
if ($resultValue === -1) throw new RuntimeException("LDAP compare error");Compare the different inputs, environment assumptions or result checks. Do not use a transport-level success value as proof that all business-level requirements were met.
Practical Example: Applying the Rule
Check permissions, server controls and returned result types before modifying live directory data.
<?php
$user = getenv('LDAP_BIND_DN'); $pass = getenv('LDAP_PASSWORD');
if (!$user || !$pass) throw new RuntimeException('LDAP credentials are required');
$ldap = ldap_connect('ldaps://directory.internal.test:636');
if (!$ldap) throw new RuntimeException('LDAP handle unavailable');
ldap_set_option($ldap, LDAP_OPT_PROTOCOL_VERSION, 3);
$base = 'ou=People,dc=example,dc=test';
$dn = 'cn=Test Member,ou=People,dc=example,dc=test';
$filterValue = 'Alice (QA)';
$filter = '(cn=' . ldap_escape($filterValue, '', LDAP_ESCAPE_FILTER) . ')';
if (!ldap_bind($ldap, $user, $pass)) throw new RuntimeException("Directory bind failed");
$resultValue = ldap_compare($ldap, $dn, "sn", "User");
echo is_bool($resultValue) ? ($resultValue ? "true" : "false") : json_encode($resultValue, JSON_PARTIAL_OUTPUT_ON_ERROR);
if ($resultValue === -1) throw new RuntimeException("LDAP compare error");In an application, convert low-level failures into controlled responses and log only non-sensitive diagnostic context.
Important Behavior and Edge Cases
Returns true, false or -1 for errors; do not treat -1 as a successful match.
LDAP filter values and DN values require different escaping flags. Never concatenate unchecked user input into a directory query.
Comparison with Related Functions or Patterns
| Approach | When it differs |
|---|---|
| ldap_compare | Checks whether one attribute of an entry equals a supplied value. |
| Related API or pattern | ldap_read retrieves attributes instead of a single equality test. |
Common Beginner Mistakes
| Mistake | Correct approach |
|---|---|
| Confusing result entries, attribute iterators and connection-level state | Returns true, false or -1 for errors; do not treat -1 as a successful match. |
| Substituting a related API without checking its semantics | ldap_read retrieves attributes instead of a single equality test. |
Key Takeaways
- Checks whether one attribute of an entry equals a supplied value.
- Returns true, false or -1 for errors; do not treat -1 as a successful match.
- ldap_read retrieves attributes instead of a single equality test.
Select this API or pattern based on its documented behavior and the trust boundaries in your own application, and test all external integrations against their actual deployments.