...
When a database field such as a password must include special characters, it is critical to ensure that the authentic data is stored in sanitized form in the database and also that any user input is normalized before the validation or comparison takes place. We discourage use of characters that have special meanings in JNDI and LDAP in the absence of a comprehensive normalization and whitelisting-based routine. Refer to VOID IDS04IDS50-JJG. Properly encode or escape output for examples on output encoding and escaping. Special characters must be transformed to sanitized safe values before they are added to the whitelist expression against which input will be validated. Likewise, normalization of user input (escaping and encoding) should occur before the validation step.
...
[API 2006]
[OWASP 2008] Preventing LDAP Injection in Java
...
VOID IDS10-J. Prevent XML external entity attacks 00. Input Validation and Data Sanitization (IDS) IDS52-J. Prevent code injection