PHP ldap_modify() Function: Usage and Examples

Replaces attributes of an existing LDAP entry; alias of ldap_mod_replace. This guide demonstrates its use in PHP code and explains when the result or side effect needs extra checks.

What It Does

Replaces attributes of an existing LDAP entry; alias of ldap_mod_replace.

Syntax and Parameters

The examples below show a real call to ldap_modify with suitable arguments. Read the function call in context: its connection, handle, input data or other prerequisites are created before use.

Requirements: LDAP extension; an LDAPS directory and scoped credentials.

These examples are for an isolated development environment. Hostnames, credentials and remote paths must be replaced with your approved configuration.

Example 1: Core Behavior

Bind to a controlled directory and use a restricted service identity.

<?php
$user = getenv('LDAP_BIND_DN'); $pass = getenv('LDAP_PASSWORD');
if (!$user || !$pass) throw new RuntimeException('LDAP credentials are required');
$ldap = ldap_connect('ldaps://directory.internal.test:636');
if (!$ldap) throw new RuntimeException('LDAP handle unavailable');
ldap_set_option($ldap, LDAP_OPT_PROTOCOL_VERSION, 3);
$base = 'ou=People,dc=example,dc=test';
$dn = 'cn=Demo User,ou=People,dc=example,dc=test';
$filterValue = 'Alice (QA)';
$filter = '(cn=' . ldap_escape($filterValue, '', LDAP_ESCAPE_FILTER) . ')';
if (!ldap_bind($ldap, $user, $pass)) throw new RuntimeException("Directory bind failed");
$resultValue = ldap_modify($ldap, $dn, ["description" => ["Reviewed record"]]);
echo is_bool($resultValue) ? ($resultValue ? "true" : "false") : json_encode($resultValue, JSON_PARTIAL_OUTPUT_ON_ERROR);

Observe the returned value or changed resource state. A successful function call can still require additional checks before a higher-level operation is considered successful.

Example 2: Alternative or Failure Case

The second example uses a different directory record or input value.

<?php
$user = getenv('LDAP_BIND_DN'); $pass = getenv('LDAP_PASSWORD');
if (!$user || !$pass) throw new RuntimeException('LDAP credentials are required');
$ldap = ldap_connect('ldaps://directory.internal.test:636');
if (!$ldap) throw new RuntimeException('LDAP handle unavailable');
ldap_set_option($ldap, LDAP_OPT_PROTOCOL_VERSION, 3);
$base = 'ou=People,dc=example,dc=test';
$dn = 'cn=Example Staff,ou=People,dc=example,dc=test';
$filterValue = 'Alice (QA)';
$filter = '(cn=' . ldap_escape($filterValue, '', LDAP_ESCAPE_FILTER) . ')';
if (!ldap_bind($ldap, $user, $pass)) throw new RuntimeException("Directory bind failed");
$resultValue = ldap_modify($ldap, $dn, ["description" => ["Reviewed record"]]);
echo is_bool($resultValue) ? ($resultValue ? "true" : "false") : json_encode($resultValue, JSON_PARTIAL_OUTPUT_ON_ERROR);

Compare the different inputs, environment assumptions or result checks. Do not use a transport-level success value as proof that all business-level requirements were met.

Practical Example: Applying the Rule

Check permissions, server controls and returned result types before modifying live directory data.

<?php
$user = getenv('LDAP_BIND_DN'); $pass = getenv('LDAP_PASSWORD');
if (!$user || !$pass) throw new RuntimeException('LDAP credentials are required');
$ldap = ldap_connect('ldaps://directory.internal.test:636');
if (!$ldap) throw new RuntimeException('LDAP handle unavailable');
ldap_set_option($ldap, LDAP_OPT_PROTOCOL_VERSION, 3);
$base = 'ou=People,dc=example,dc=test';
$dn = 'cn=Test Member,ou=People,dc=example,dc=test';
$filterValue = 'Alice (QA)';
$filter = '(cn=' . ldap_escape($filterValue, '', LDAP_ESCAPE_FILTER) . ')';
if (!ldap_bind($ldap, $user, $pass)) throw new RuntimeException("Directory bind failed");
$resultValue = ldap_modify($ldap, $dn, ["description" => ["Reviewed record"]]);
echo is_bool($resultValue) ? ($resultValue ? "true" : "false") : json_encode($resultValue, JSON_PARTIAL_OUTPUT_ON_ERROR);

In an application, convert low-level failures into controlled responses and log only non-sensitive diagnostic context.

Important Behavior and Edge Cases

Values must match the LDAP schema and write permissions; empty arrays can remove attributes.

LDAP filter values and DN values require different escaping flags. Never concatenate unchecked user input into a directory query.

Comparison with Related Functions or Patterns

Common Beginner Mistakes

Key Takeaways

• Replaces attributes of an existing LDAP entry; alias of ldap_mod_replace.
• Values must match the LDAP schema and write permissions; empty arrays can remove attributes.
• ldap_add creates a new entry.

Select this API or pattern based on its documented behavior and the trust boundaries in your own application, and test all external integrations against their actual deployments.