安全的LDAP PHP脚本？

Question

我想知道我的脚本是否安全。特别是将序列化对象存储在会话变量中。

index.php是受保护站点的登录（我省略了html部分）。受保护的站点从LDAP读取和打印Infos。为了从用户条目读取LDAP信息，用户必须与LDAP绑定，否则ldap_read将返回错误。没有在main.php中的用户绑定是我错误的第一次尝试。

如果登录成功，另一种可能性是在index.php中包含main.php。但我不想这样做。

所以我尝试了这种方式它可以工作，但我不确定这是多么安全。特别是会话变量中的对象。

# index.php
<?php
    session_start();
    include_once("LDAP.php");
    if (isset($_POST) && isset($_POST['loginName']) && isset($_POST['loginPassword'])){        
        $ActiveDirectoryUser = new ActiveDirectoryUser($_POST['loginName'], $_POST['loginPassword']);
        if ($ActiveDirectoryUser->connect()) {                
            $_SESSION['unique_string'] = true;
            $_SESSION['unique_string_Obj'] = serialize($ActiveDirectoryUser);
            header('Location: main.php');
        }
    }
?>

# LDAP.php
<?php
/**
 * Always have documentation here
 */
class ActiveDirectoryUser {
    private $connection;
    private $username;
    private $password;
    private $ldap_db = "Server Adress";
    private $ldap_connection;

    /**
     * Always have documentation 
     * @param $username string
     * @param $password string
     */
    public function __construct($username, $password) {
      $this->username = "uid=".$username.",ou=users,dc="company_name",dc=de";
      $this->password = $password;
    }

    /**
     * Always have documentation
     */
    public function __destruct(){
        ldap_close($this->ldap_connection);
    }

    /**
     * Always have documentation 
     * @param $username string
     * @param $password string
     */

    public function connect() {
        $this->ldap_connection = ldap_connect($this->ldap_db);

        if ($bind = ldap_bind($this->ldap_connection, $this->username, $this->password)) {
            return True;
        } else {
            return False;
        }
    }

    /**
     * Always have documentation
     */
    public function getInfos(){
        ldap_set_option($this->ldap_connection, LDAP_OPT_PROTOCOL_VERSION, 3);
        ldap_set_option($this->ldap_connection, LDAP_OPT_REFERRALS, 0);

        $bind = ldap_bind($this->ldap_connection, $this->username, $this->password);

        $filter = "(objectclass=*)";

        $justthese = array("sn", "givenname", "mail");

        $sr = ldap_read($this->ldap_connection, $this->username, $filter, $justthese);

        $info = ldap_get_entries($this->ldap_connection, $sr);

        return $info;
    }
}
?>

# main.php
<?php
    session_start();
    include_once("LDAP.php");
    $ActiveDirectoryUser = unserialize($_SESSION["unique_string_Obj"]);            
    if($ActiveDirectoryUser->connect()) {                
        $entry = $ActiveDirectoryUser->getInfos();
    }
?>