If a value should contain any of the following characters

           Character       ASCII value
           ---------------------------
           *               0x2a
           (               0x28
           )               0x29
           \               0x5c
           NUL             0x00

   the character must be encoded as the backslash '\' character (ASCII
   0x5c) followed by the two hexadecimal digits representing the ASCII
   value of the encoded character. The case of the two hexadecimal
   digits is not significant.

   This simple escaping mechanism eliminates filter-parsing ambiguities
   and allows any filter that can be represented in LDAP to be
   represented as a NUL-terminated string. Other characters besides the
   ones listed above may be escaped using this mechanism, for example,
   non-printing characters.

   For example, the filter checking whether the "cn" attribute contained
   a value with the character "*" anywhere in it would be represented as
   "(cn=*\2a*)".

   Note that although both the substring and present productions in the
   grammar above can produce the "attr=*" construct, this construct is
   used only to denote a presence filter.