merge from 5.2

20 files changed, 381 insertions, 360 deletions

diff --git a/sql/ha_ndbcluster_binlog.cc b/sql/ha_ndbcluster_binlog.cc
index e32736ba5ba..28aff3f613e 100644
--- a/sql/ha_ndbcluster_binlog.cc
+++ b/sql/ha_ndbcluster_binlog.cc
@@ -1268,7 +1268,9 @@ int ndbcluster_log_schema_op(THD *thd, NDB_SHARE *share,
     DBUG_RETURN(0);
   }
 
-  char tmp_buf2[FN_REFLEN];
+  char tmp_buf2_mem[FN_REFLEN];
+  String tmp_buf2(tmp_buf2_mem, sizeof(tmp_buf2_mem), system_charset_info);
+  tmp_buf2.length(0);
   const char *type_str;
   switch (type)
   {
@@ -1277,17 +1279,24 @@ int ndbcluster_log_schema_op(THD *thd, NDB_SHARE *share,
     if (thd->lex->sql_command ==  SQLCOM_DROP_DB)
       DBUG_RETURN(0);
     /* redo the drop table query as is may contain several tables */
-    query= tmp_buf2;
-    query_length= (uint) (strxmov(tmp_buf2, "drop table `",
-                                  table_name, "`", NullS) - tmp_buf2);
+    tmp_buf2.append(STRING_WITH_LEN("drop table "));
+    append_identifier(thd, &tmp_buf2, table_name, strlen(table_name));
+    query= tmp_buf2.c_ptr_safe();
+    query_length= tmp_buf2.length();
     type_str= "drop table";
     break;
   case SOT_RENAME_TABLE:
     /* redo the rename table query as is may contain several tables */
-    query= tmp_buf2;
-    query_length= (uint) (strxmov(tmp_buf2, "rename table `",
-                                  db, ".", table_name, "` to `",
-                                  new_db, ".", new_table_name, "`", NullS) - tmp_buf2);
+    tmp_buf2.append(STRING_WITH_LEN("rename table "));
+    append_identifier(thd, &tmp_buf2, db, strlen(db));
+    tmp_buf2.append(STRING_WITH_LEN("."));
+    append_identifier(thd, &tmp_buf2, table_name, strlen(table_name));
+    tmp_buf2.append(STRING_WITH_LEN(" to "));
+    append_identifier(thd, &tmp_buf2, new_db, strlen(new_db));
+    tmp_buf2.append(STRING_WITH_LEN("."));
+    append_identifier(thd, &tmp_buf2, new_table_name, strlen(new_table_name));
+    query= tmp_buf2.c_ptr_safe();
+    query_length= tmp_buf2.length();
     type_str= "rename table";
     break;
   case SOT_CREATE_TABLE:
diff --git a/sql/item.cc b/sql/item.cc
index a549fde3f5c..657e89dff7b 100644
--- a/sql/item.cc
+++ b/sql/item.cc
@@ -942,15 +942,31 @@ void Item::set_name(const char *str, uint length, CHARSET_INFO *cs)
   if (!my_charset_same(cs, system_charset_info))
   {
     size_t res_length;
-    name= sql_strmake_with_convert(str, name_length= length, cs,
+    name= sql_strmake_with_convert(str, length, cs,
 				   MAX_ALIAS_NAME, system_charset_info,
 				   &res_length);
+    name_length= res_length;
   }
   else
     name= sql_strmake(str, (name_length= min(length,MAX_ALIAS_NAME)));
 }
 
 
+void Item::set_name_no_truncate(const char *str, uint length, CHARSET_INFO *cs)
+{
+  if (!my_charset_same(cs, system_charset_info))
+  {
+    size_t res_length;
+    name= sql_strmake_with_convert(str, length, cs,
+				   UINT_MAX, system_charset_info,
+				   &res_length);
+    name_length= res_length;
+  }
+  else
+    name= sql_strmake(str, (name_length= length));
+}
+
+
 void Item::set_name_for_rollback(THD *thd, const char *str, uint length,
                                  CHARSET_INFO *cs)
 {
diff --git a/sql/item.h b/sql/item.h
index 4953c0c5c9f..ab5243a3d0a 100644
--- a/sql/item.h
+++ b/sql/item.h
@@ -620,6 +620,7 @@ public:
 #endif
   }		/*lint -e1509 */
   void set_name(const char *str, uint length, CHARSET_INFO *cs);
+  void set_name_no_truncate(const char *str, uint length, CHARSET_INFO *cs);
   void set_name_for_rollback(THD *thd, const char *str, uint length,
                              CHARSET_INFO *cs);
   void rename(char *new_name);
diff --git a/sql/item_func.cc b/sql/item_func.cc
index 00f8496b63b..42332d6b1b2 100644
--- a/sql/item_func.cc
+++ b/sql/item_func.cc
@@ -4913,7 +4913,7 @@ enum Item_result Item_func_get_user_var::result_type() const
 void Item_func_get_user_var::print(String *str, enum_query_type query_type)
 {
   str->append(STRING_WITH_LEN("(@"));
-  str->append(name.str,name.length);
+  append_identifier(current_thd, str, name.str, name.length);
   str->append(')');
 }
 
@@ -5011,10 +5011,10 @@ my_decimal* Item_user_var_as_out_param::val_decimal(my_decimal *decimal_buffer)
 }
 
 
-void Item_user_var_as_out_param::print(String *str, enum_query_type query_type)
+void Item_user_var_as_out_param::print_for_load(THD *thd, String *str)
 {
   str->append('@');
-  str->append(name.str,name.length);
+  append_identifier(thd, str, name.str, name.length);
 }
 
 
diff --git a/sql/item_func.h b/sql/item_func.h
index abaf07c51d5..670039ef9b9 100644
--- a/sql/item_func.h
+++ b/sql/item_func.h
@@ -1582,7 +1582,7 @@ public:
   my_decimal *val_decimal(my_decimal *decimal_buffer);
   /* fix_fields() binds variable name with its entry structure */
   bool fix_fields(THD *thd, Item **ref);
-  virtual void print(String *str, enum_query_type query_type);
+  void print_for_load(THD *thd, String *str);
   void set_null_value(CHARSET_INFO* cs);
   void set_value(const char *str, uint length, CHARSET_INFO* cs);
 };
diff --git a/sql/log.cc b/sql/log.cc
index 7c25de96365..0c954744041 100644
--- a/sql/log.cc
+++ b/sql/log.cc
@@ -39,6 +39,7 @@
 
 #include <mysql/plugin.h>
 #include "debug_sync.h"
+#include "sql_show.h"
 
 /* max size of the log message */
 #define MAX_LOG_BUFFER_SIZE 1024
@@ -1794,9 +1795,8 @@ static int binlog_savepoint_set(handlerton *hton, THD *thd, void *sv)
 
   String log_query;
   if (log_query.append(STRING_WITH_LEN("SAVEPOINT ")) ||
-      log_query.append("`") ||
-      log_query.append(thd->lex->ident.str, thd->lex->ident.length) ||
-      log_query.append("`"))
+      append_identifier(thd, &log_query,
+                        thd->lex->ident.str, thd->lex->ident.length))
     DBUG_RETURN(1);
   int errcode= query_error_code(thd, thd->killed == NOT_KILLED);
   Query_log_event qinfo(thd, log_query.ptr(), log_query.length(),
@@ -1818,9 +1818,8 @@ static int binlog_savepoint_rollback(handlerton *hton, THD *thd, void *sv)
   {
     String log_query;
     if (log_query.append(STRING_WITH_LEN("ROLLBACK TO ")) ||
-        log_query.append("`") ||
-        log_query.append(thd->lex->ident.str, thd->lex->ident.length) ||
-        log_query.append("`"))
+        append_identifier(thd, &log_query,
+                          thd->lex->ident.str, thd->lex->ident.length))
       DBUG_RETURN(1);
     int errcode= query_error_code(thd, thd->killed == NOT_KILLED);
     Query_log_event qinfo(thd, log_query.ptr(), log_query.length(),
diff --git a/sql/log_event.cc b/sql/log_event.cc
index a2f6cf73510..2221bc60ae6 100644
--- a/sql/log_event.cc
+++ b/sql/log_event.cc
@@ -34,6 +34,7 @@
 #include "rpl_utility.h"
 #include "rpl_record.h"
 #include <my_dir.h>
+#include "sql_show.h"
 
 #endif /* MYSQL_CLIENT */
 
@@ -457,29 +458,28 @@ inline bool unexpected_error_code(int unexpected_error)
   pretty_print_str()
 */
 
-static char *pretty_print_str(char *packet, const char *str, int len)
+static void
+pretty_print_str(String *packet, const char *str, int len)
 {
   const char *end= str + len;
-  char *pos= packet;
-  *pos++= '\'';
+  packet->append(STRING_WITH_LEN("'"));
   while (str < end)
   {
     char c;
     switch ((c=*str++)) {
-    case '\n': *pos++= '\\'; *pos++= 'n'; break;
-    case '\r': *pos++= '\\'; *pos++= 'r'; break;
-    case '\\': *pos++= '\\'; *pos++= '\\'; break;
-    case '\b': *pos++= '\\'; *pos++= 'b'; break;
-    case '\t': *pos++= '\\'; *pos++= 't'; break;
-    case '\'': *pos++= '\\'; *pos++= '\''; break;
-    case 0   : *pos++= '\\'; *pos++= '0'; break;
+    case '\n': packet->append(STRING_WITH_LEN("\\n")); break;
+    case '\r': packet->append(STRING_WITH_LEN("\\r")); break;
+    case '\\': packet->append(STRING_WITH_LEN("\\\\")); break;
+    case '\b': packet->append(STRING_WITH_LEN("\\b")); break;
+    case '\t': packet->append(STRING_WITH_LEN("\\t")); break;
+    case '\'': packet->append(STRING_WITH_LEN("\\'")); break;
+    case 0   : packet->append(STRING_WITH_LEN("\\0")); break;
     default:
-      *pos++= c;
+      packet->append(&c, 1);
       break;
     }
   }
-  *pos++= '\'';
-  return pos;
+  packet->append(STRING_WITH_LEN("'"));
 }
 #endif /* !MYSQL_CLIENT */
 
@@ -904,7 +904,7 @@ Log_event::do_shall_skip(Relay_log_info *rli)
   Log_event::pack_info()
 */
 
-void Log_event::pack_info(Protocol *protocol)
+void Log_event::pack_info(THD *thd, Protocol *protocol)
 {
   protocol->store("", &my_charset_bin);
 }
@@ -913,7 +913,8 @@ void Log_event::pack_info(Protocol *protocol)
 /**
   Only called by SHOW BINLOG EVENTS
 */
-int Log_event::net_send(Protocol *protocol, const char* log_name, my_off_t pos)
+int Log_event::net_send(THD *thd, Protocol *protocol, const char* log_name,
+                        my_off_t pos)
 {
   const char *p= strrchr(log_name, FN_LIBCHAR);
   const char *event_type;
@@ -927,7 +928,7 @@ int Log_event::net_send(Protocol *protocol, const char* log_name, my_off_t pos)
   protocol->store(event_type, strlen(event_type), &my_charset_bin);
   protocol->store((uint32) server_id);
   protocol->store((ulonglong) log_pos);
-  pack_info(protocol);
+  pack_info(thd, protocol);
   return protocol->write();
 }
 #endif /* HAVE_REPLICATION */
@@ -2428,27 +2429,22 @@ Log_event::continue_group(Relay_log_info *rli)
     show the catalog ??
 */
 
-void Query_log_event::pack_info(Protocol *protocol)
+void Query_log_event::pack_info(THD *thd, Protocol *protocol)
 {
   // TODO: show the catalog ??
-  char *buf, *pos;
-  if (!(buf= (char*) my_malloc(9 + db_len + q_len, MYF(MY_WME))))
-    return;
-  pos= buf;
+  char buf_mem[1024];
+  String buf(buf_mem, sizeof(buf_mem), system_charset_info);
+  buf.real_alloc(9 + db_len + q_len);
   if (!(flags & LOG_EVENT_SUPPRESS_USE_F)
       && db && db_len)
   {
-    pos= strmov(buf, "use `");
-    memcpy(pos, db, db_len);
-    pos= strmov(pos+db_len, "`; ");
+    buf.append(STRING_WITH_LEN("use "));
+    append_identifier(thd, &buf, db, db_len);
+    buf.append("; ");
   }
   if (query && q_len)
-  {
-    memcpy(pos, query, q_len);
-    pos+= q_len;
-  }
-  protocol->store(buf, pos-buf, &my_charset_bin);
-  my_free(buf, MYF(MY_ALLOW_ZERO_PTR));
+    buf.append(query, q_len);
+  protocol->store(&buf);
 }
 #endif
 
@@ -3233,11 +3229,17 @@ void Query_log_event::print_query_header(IO_CACHE* file,
   }
   else if (db)
   {
+    /* Room for expand ` to `` + initial/final ` + \0 */
+    char buf[FN_REFLEN*2+3];
+
     different_db= memcmp(print_event_info->db, db, db_len + 1);
     if (different_db)
       memcpy(print_event_info->db, db, db_len + 1);
     if (db[0] && different_db) 
-      my_b_printf(file, "use %s%s\n", db, print_event_info->delimiter);
+    {
+      my_snprintf(buf, sizeof(buf), "%`s", db);
+      my_b_printf(file, "use %s%s\n", buf, print_event_info->delimiter);
+    }
   }
 
   end=int10_to_str((long) when, strmov(buff,"SET TIMESTAMP="),10);
@@ -3859,7 +3861,7 @@ Start_log_event_v3::Start_log_event_v3()
 */
 
 #if defined(HAVE_REPLICATION) && !defined(MYSQL_CLIENT)
-void Start_log_event_v3::pack_info(Protocol *protocol)
+void Start_log_event_v3::pack_info(THD *thd, Protocol *protocol)
 {
   char buf[12 + ST_SERVER_VER_LEN + 14 + 22], *pos;
   pos= strmov(buf, "Server ver: ");
@@ -4635,131 +4637,115 @@ uint8 get_checksum_alg(const char* buf, ulong len)
 */
 
 #if defined(HAVE_REPLICATION) && !defined(MYSQL_CLIENT)
-uint Load_log_event::get_query_buffer_length()
+void Load_log_event::print_query(THD *thd, bool need_db, const char *cs,
+                                 String *buf, my_off_t *fn_start,
+                                 my_off_t *fn_end, const char *qualify_db)
 {
-  return
-    5 + db_len + 3 +                        // "use DB; "
-    18 + fname_len + 2 +                    // "LOAD DATA INFILE 'file''"
-    11 +                                    // "CONCURRENT "
-    7 +					    // LOCAL
-    9 +                                     // " REPLACE or IGNORE "
-    13 + table_name_len*2 +                 // "INTO TABLE `table`"
-    21 + sql_ex.field_term_len*4 + 2 +      // " FIELDS TERMINATED BY 'str'"
-    23 + sql_ex.enclosed_len*4 + 2 +        // " OPTIONALLY ENCLOSED BY 'str'"
-    12 + sql_ex.escaped_len*4 + 2 +         // " ESCAPED BY 'str'"
-    21 + sql_ex.line_term_len*4 + 2 +       // " LINES TERMINATED BY 'str'"
-    19 + sql_ex.line_start_len*4 + 2 +      // " LINES STARTING BY 'str'"
-    15 + 22 +                               // " IGNORE xxx  LINES"
-    3 + (num_fields-1)*2 + field_block_len; // " (field1, field2, ...)"
-}
-
-
-void Load_log_event::print_query(bool need_db, const char *cs, char *buf,
-                                 char **end, char **fn_start, char **fn_end)
-{
-  char *pos= buf;
-
   if (need_db && db && db_len)
   {
-    pos= strmov(pos, "use `");
-    memcpy(pos, db, db_len);
-    pos= strmov(pos+db_len, "`; ");
+    buf->append(STRING_WITH_LEN("use "));
+    append_identifier(thd, buf, db, db_len);
+    buf->append(STRING_WITH_LEN("; "));
   }
 
-  pos= strmov(pos, "LOAD DATA ");
+  buf->append(STRING_WITH_LEN("LOAD DATA "));
 
   if (thd->lex->lock_option == TL_WRITE_CONCURRENT_INSERT)
-    pos= strmov(pos, "CONCURRENT ");
+    buf->append(STRING_WITH_LEN("CONCURRENT "));
 
   if (fn_start)
-    *fn_start= pos;
+    *fn_start= buf->length();
 
   if (check_fname_outside_temp_buf())
-    pos= strmov(pos, "LOCAL ");
-  pos= strmov(pos, "INFILE '");
-  memcpy(pos, fname, fname_len);
-  pos= strmov(pos+fname_len, "' ");
+    buf->append(STRING_WITH_LEN("LOCAL "));
+  buf->append(STRING_WITH_LEN("INFILE '"));
+  buf->append_for_single_quote(fname, fname_len);
+  buf->append(STRING_WITH_LEN("' "));
 
   if (sql_ex.opt_flags & REPLACE_FLAG)
-    pos= strmov(pos, "REPLACE ");
+    buf->append(STRING_WITH_LEN("REPLACE "));
   else if (sql_ex.opt_flags & IGNORE_FLAG)
-    pos= strmov(pos, "IGNORE ");
+    buf->append(STRING_WITH_LEN("IGNORE "));
 
-  pos= strmov(pos ,"INTO");
+  buf->append(STRING_WITH_LEN("INTO"));
 
   if (fn_end)
-    *fn_end= pos;
+    *fn_end= buf->length();
 
-  pos= strmov(pos ," TABLE `");
-  memcpy(pos, table_name, table_name_len);
-  pos+= table_name_len;
+  buf->append(STRING_WITH_LEN(" TABLE "));
+  if (qualify_db)
+  {
+    append_identifier(thd, buf, qualify_db, strlen(qualify_db));
+    buf->append(STRING_WITH_LEN("."));
+  }
+  append_identifier(thd, buf, table_name, table_name_len);
 
   if (cs != NULL)
   {
-    pos= strmov(pos ,"` CHARACTER SET ");
-    pos= strmov(pos ,  cs);
+    buf->append(STRING_WITH_LEN(" CHARACTER SET "));
+    buf->append(cs, strlen(cs));
   }
-  else
-    pos= strmov(pos, "`");
 
   /* We have to create all optional fields as the default is not empty */
-  pos= strmov(pos, " FIELDS TERMINATED BY ");
-  pos= pretty_print_str(pos, sql_ex.field_term, sql_ex.field_term_len);
+  buf->append(STRING_WITH_LEN(" FIELDS TERMINATED BY "));
+  pretty_print_str(buf, sql_ex.field_term, sql_ex.field_term_len);
   if (sql_ex.opt_flags & OPT_ENCLOSED_FLAG)
-    pos= strmov(pos, " OPTIONALLY ");
-  pos= strmov(pos, " ENCLOSED BY ");
-  pos= pretty_print_str(pos, sql_ex.enclosed, sql_ex.enclosed_len);
+    buf->append(STRING_WITH_LEN(" OPTIONALLY "));
+  buf->append(STRING_WITH_LEN(" ENCLOSED BY "));
+  pretty_print_str(buf, sql_ex.enclosed, sql_ex.enclosed_len);
 
-  pos= strmov(pos, " ESCAPED BY ");
-  pos= pretty_print_str(pos, sql_ex.escaped, sql_ex.escaped_len);
+  buf->append(STRING_WITH_LEN(" ESCAPED BY "));
+  pretty_print_str(buf, sql_ex.escaped, sql_ex.escaped_len);
 
-  pos= strmov(pos, " LINES TERMINATED BY ");
-  pos= pretty_print_str(pos, sql_ex.line_term, sql_ex.line_term_len);
+  buf->append(STRING_WITH_LEN(" LINES TERMINATED BY "));
+  pretty_print_str(buf, sql_ex.line_term, sql_ex.line_term_len);
   if (sql_ex.line_start_len)
   {
-    pos= strmov(pos, " STARTING BY ");
-    pos= pretty_print_str(pos, sql_ex.line_start, sql_ex.line_start_len);
+    buf->append(STRING_WITH_LEN(" STARTING BY "));
+    pretty_print_str(buf, sql_ex.line_start, sql_ex.line_start_len);
   }
 
   if ((long) skip_lines > 0)
   {
-    pos= strmov(pos, " IGNORE ");
-    pos= longlong10_to_str((longlong) skip_lines, pos, 10);
-    pos= strmov(pos," LINES ");    
+    char skipbuf[22];
+    buf->append(STRING_WITH_LEN(" IGNORE "));
+    longlong10_to_str((longlong) skip_lines, skipbuf, 10);
+    buf->append(skipbuf);
+    buf->append(STRING_WITH_LEN(" LINES "));
   }
 
   if (num_fields)
   {
     uint i;
     const char *field= fields;
-    pos= strmov(pos, " (");
+    buf->append(STRING_WITH_LEN(" ("));
     for (i = 0; i < num_fields; i++)
     {
       if (i)
       {
-        *pos++= ' ';
-        *pos++= ',';
+        /*
+          Yes, the space and comma is reversed here. But this is mostly dead
+          code, at most used when reading really old binlogs from old servers,
+          so better just leave it as is...
+        */
+        buf->append(STRING_WITH_LEN(" ,"));
       }
-      memcpy(pos, field, field_lens[i]);
-      pos+=   field_lens[i];
+      append_identifier(thd, buf, field, field_lens[i]);
       field+= field_lens[i]  + 1;
     }
-    *pos++= ')';
+    buf->append(STRING_WITH_LEN(")"));
   }
-
-  *end= pos;
 }
 
 
-void Load_log_event::pack_info(Protocol *protocol)
+void Load_log_event::pack_info(THD *thd, Protocol *protocol)
 {
-  char *buf, *end;
+  char query_buffer[1024];
+  String query_str(query_buffer, sizeof(query_buffer), system_charset_info);
 
-  if (!(buf= (char*) my_malloc(get_query_buffer_length(), MYF(MY_WME))))
-    return;
-  print_query(TRUE, NULL, buf, &end, 0, 0);
-  protocol->store(buf, end-buf, &my_charset_bin);
-  my_free(buf, MYF(0));
+  query_str.length(0);
+  print_query(thd, TRUE, NULL, &query_str, 0, 0, NULL);
+  protocol->store(query_str.ptr(), query_str.length(), &my_charset_bin);
 }
 #endif /* defined(HAVE_REPLICATION) && !defined(MYSQL_CLIENT) */
 
@@ -5026,7 +5012,7 @@ void Load_log_event::print(FILE* file_arg, PRINT_EVENT_INFO* print_event_info,
   else if (sql_ex.opt_flags & IGNORE_FLAG)
     my_b_printf(&cache,"IGNORE ");
   
-  my_b_printf(&cache, "INTO TABLE `%s`", table_name);
+  my_b_printf(&cache, "INTO TABLE %`s", table_name);
   my_b_printf(&cache, " FIELDS TERMINATED BY ");
   pretty_print_str(&cache, sql_ex.field_term, sql_ex.field_term_len);
 
@@ -5215,16 +5201,20 @@ int Load_log_event::do_apply_event(NET* net, Relay_log_info const *rli,
     else
     {
       char llbuff[22];
-      char *end;
       enum enum_duplicates handle_dup;
       bool ignore= 0;
+      char query_buffer[1024];
+      String query_str(query_buffer, sizeof(query_buffer), system_charset_info);
       char *load_data_query;
 
+      query_str.length(0);
       /*
         Forge LOAD DATA INFILE query which will be used in SHOW PROCESS LIST
         and written to slave's binlog if binlogging is on.
       */
-      if (!(load_data_query= (char *)thd->alloc(get_query_buffer_length() + 1)))
+      print_query(thd, FALSE, NULL, &query_str, NULL, NULL, NULL);
+      if (!(load_data_query= (char *)thd->strmake(query_str.ptr(),
+                                                  query_str.length())))
       {
         /*
           This will set thd->fatal_error in case of OOM. So we surely will notice
@@ -5233,9 +5223,7 @@ int Load_log_event::do_apply_event(NET* net, Relay_log_info const *rli,
         goto error;
       }
 
-      print_query(FALSE, NULL, load_data_query, &end, NULL, NULL);
-      *end= 0;
-      thd->set_query(load_data_query, (uint) (end - load_data_query));
+      thd->set_query(load_data_query, (uint) (query_str.length()));
 
       if (sql_ex.opt_flags & REPLACE_FLAG)
       {
@@ -5400,7 +5388,7 @@ Error '%s' running LOAD DATA INFILE on table '%s'. Default database: '%s'",
 */
 
 #if defined(HAVE_REPLICATION) && !defined(MYSQL_CLIENT)
-void Rotate_log_event::pack_info(Protocol *protocol)
+void Rotate_log_event::pack_info(THD *thd, Protocol *protocol)
 {
   char buf1[256], buf[22];
   String tmp(buf1, sizeof(buf1), log_cs);
@@ -5618,7 +5606,7 @@ Rotate_log_event::do_shall_skip(Relay_log_info *rli)
 */
 
 #if defined(HAVE_REPLICATION) && !defined(MYSQL_CLIENT)
-void Intvar_log_event::pack_info(Protocol *protocol)
+void Intvar_log_event::pack_info(THD *thd, Protocol *protocol)
 {
   char buf[256], *pos;
   pos= strmake(buf, get_var_type_name(), sizeof(buf)-23);
@@ -5768,7 +5756,7 @@ Intvar_log_event::do_shall_skip(Relay_log_info *rli)
 **************************************************************************/
 
 #if defined(HAVE_REPLICATION) && !defined(MYSQL_CLIENT)
-void Rand_log_event::pack_info(Protocol *protocol)
+void Rand_log_event::pack_info(THD *thd, Protocol *protocol)
 {
   char buf1[256], *pos;
   pos= strmov(buf1,"rand_seed1=");
@@ -5867,7 +5855,7 @@ Rand_log_event::do_shall_skip(Relay_log_info *rli)
 **************************************************************************/
 
 #if defined(HAVE_REPLICATION) && !defined(MYSQL_CLIENT)
-void Xid_log_event::pack_info(Protocol *protocol)
+void Xid_log_event::pack_info(THD *thd, Protocol *protocol)
 {
   char buf[128], *pos;
   pos= strmov(buf, "COMMIT /* xid=");
@@ -5955,69 +5943,109 @@ Xid_log_event::do_shall_skip(Relay_log_info *rli)
 **************************************************************************/
 
 #if defined(HAVE_REPLICATION) && !defined(MYSQL_CLIENT)
-void User_var_log_event::pack_info(Protocol* protocol)
+static bool
+user_var_append_name_part(THD *thd, String *buf,
+                          const char *name, size_t name_len)
 {
-  char *buf= 0;
-  uint val_offset= 4 + name_len;
-  uint event_len= val_offset;
+  return buf->append("@") ||
+    append_identifier(thd, buf, name, name_len) ||
+    buf->append("=");
+}
 
+void User_var_log_event::pack_info(THD *thd, Protocol* protocol)
+{
   if (is_null)
   {
-    if (!(buf= (char*) my_malloc(val_offset + 5, MYF(MY_WME))))
+    char buf_mem[FN_REFLEN+7];
+    String buf(buf_mem, sizeof(buf_mem), system_charset_info);
+    buf.length(0);
+    if (user_var_append_name_part(thd, &buf, name, name_len) ||
+        buf.append("NULL"))
       return;
-    strmov(buf + val_offset, "NULL");
-    event_len= val_offset + 4;
+    protocol->store(buf.ptr(), buf.length(), &my_charset_bin);
   }
   else
   {
     switch (type) {
     case REAL_RESULT:
+    {
       double real_val;
+      char buf2[FLOATING_POINT_BUFFER];
+      char buf_mem[FN_REFLEN + FLOATING_POINT_BUFFER];
+      String buf(buf_mem, sizeof(buf_mem), system_charset_info);
       float8get(real_val, val);
-      if (!(buf= (char*) my_malloc(val_offset + FLOATING_POINT_BUFFER,
-                                   MYF(MY_WME))))
-        return;
-      event_len+= my_sprintf(buf + val_offset,
-			     (buf + val_offset, "%.14g", real_val));
+      buf.length(0);
+      my_sprintf(buf2, (buf2, "%.14g", real_val));
+      if (user_var_append_name_part(thd, &buf, name, name_len) ||
+          buf.append(buf2))
+         return;
+      protocol->store(buf.ptr(), buf.length(), &my_charset_bin);
       break;
+    }
     case INT_RESULT:
-      if (!(buf= (char*) my_malloc(val_offset + 22, MYF(MY_WME))))
+    {
+      char buf2[22];
+      char buf_mem[FN_REFLEN + 22];
+      String buf(buf_mem, sizeof(buf_mem), system_charset_info);
+      buf.length(0);
+      if (user_var_append_name_part(thd, &buf, name, name_len) ||
+          buf.append(buf2, longlong10_to_str(uint8korr(val), buf2, -10)-buf2))
         return;
-      event_len= longlong10_to_str(uint8korr(val), buf + val_offset,-10)-buf;
+      protocol->store(buf.ptr(), buf.length(), &my_charset_bin);
       break;
+    }
     case DECIMAL_RESULT:
     {
-      if (!(buf= (char*) my_malloc(val_offset + DECIMAL_MAX_STR_LENGTH,
-                                   MYF(MY_WME))))
-        return;
-      String str(buf+val_offset, DECIMAL_MAX_STR_LENGTH, &my_charset_bin);
+      char buf_mem[FN_REFLEN + DECIMAL_MAX_STR_LENGTH];
+      String buf(buf_mem, sizeof(buf_mem), system_charset_info);
+      char buf2[DECIMAL_MAX_STR_LENGTH+1];
+      String str(buf2, sizeof(buf2), &my_charset_bin);
       my_decimal dec;
+      buf.length(0);
       binary2my_decimal(E_DEC_FATAL_ERROR, (uchar*) (val+2), &dec, val[0],
                         val[1]);
       my_decimal2string(E_DEC_FATAL_ERROR, &dec, 0, 0, 0, &str);
-      event_len= str.length() + val_offset;
+      if (user_var_append_name_part(thd, &buf, name, name_len) ||
+          buf.append(buf2))
+        return;
+      protocol->store(buf.ptr(), buf.length(), &my_charset_bin);
       break;
     } 
     case STRING_RESULT:
+    {
       /* 15 is for 'COLLATE' and other chars */
-      buf= (char*) my_malloc(event_len+val_len*2+1+2*MY_CS_NAME_SIZE+15,
-                             MYF(MY_WME));
+      char buf_mem[FN_REFLEN + 512 + 1 + 2*MY_CS_NAME_SIZE+15];
+      String buf(buf_mem, sizeof(buf_mem), system_charset_info);
       CHARSET_INFO *cs;
-      if (!buf)
-        return;
+      buf.length(0);
       if (!(cs= get_charset(charset_number, MYF(0))))
       {
-        strmov(buf+val_offset, "???");
-        event_len+= 3;
+        if (buf.append("???"))
+          return;
       }
       else
       {
-        char *p= strxmov(buf + val_offset, "_", cs->csname, " ", NullS);
-        p= str_to_hex(p, val, val_len);
-        p= strxmov(p, " COLLATE ", cs->name, NullS);
-        event_len= p-buf;
+        size_t old_len;
+        char *beg, *end;
+        if (user_var_append_name_part(thd, &buf, name, name_len) ||
+            buf.append("_") ||
+            buf.append(cs->csname) ||
+            buf.append(" "))
+          return;
+        old_len= buf.length();
+        if (buf.reserve(old_len + val_len*2 + 2 + sizeof(" COLLATE ") +
+                        MY_CS_NAME_SIZE))
+          return;
+        beg= const_cast<char *>(buf.ptr()) + old_len;
+        end= str_to_hex(beg, val, val_len);
+        buf.length(old_len + (end - beg));
+        if (buf.append(" COLLATE ") ||
+            buf.append(cs->name))
+          return;
       }
+      protocol->store(buf.ptr(), buf.length(), &my_charset_bin);
       break;
+    }
     case ROW_RESULT:
     case IMPOSSIBLE_RESULT:
     default:
@@ -6025,13 +6053,6 @@ void User_var_log_event::pack_info(Protocol* protocol)
       return;
     }
   }
-  buf[0]= '@';
-  buf[1]= '`';
-  memcpy(buf+2, name, name_len);
-  buf[2+name_len]= '`';
-  buf[3+name_len]= '=';
-  protocol->store(buf, event_len, &my_charset_bin);
-  my_free(buf, MYF(0));
 }
 #endif /* !MYSQL_CLIENT */
 
@@ -6148,9 +6169,8 @@ void User_var_log_event::print(FILE* file, PRINT_EVENT_INFO* print_event_info)
     my_b_printf(&cache, "\tUser_var\n");
   }
 
-  my_b_printf(&cache, "SET @`");
-  my_b_write(&cache, (uchar*) name, (uint) (name_len));
-  my_b_printf(&cache, "`");
+  my_b_printf(&cache, "SET @");
+  my_b_write_backtick_quote(&cache, name, name_len);
 
   if (is_null)
   {
@@ -6223,7 +6243,7 @@ void User_var_log_event::print(FILE* file, PRINT_EVENT_INFO* print_event_info)
         */
         my_b_printf(&cache, ":=???%s\n", print_event_info->delimiter);
       else
-        my_b_printf(&cache, ":=_%s %s COLLATE `%s`%s\n",
+        my_b_printf(&cache, ":=_%s %s COLLATE %`s%s\n",
                     cs->csname, hex_str, cs->name,
                     print_event_info->delimiter);
       my_afree(hex_str);
@@ -6362,7 +6382,7 @@ void Unknown_log_event::print(FILE* file_arg, PRINT_EVENT_INFO* print_event_info
 #endif  
 
 #ifndef MYSQL_CLIENT
-void Slave_log_event::pack_info(Protocol *protocol)
+void Slave_log_event::pack_info(THD *thd, Protocol *protocol)
 {
   char buf[256+HOSTNAME_LENGTH], *pos;
   pos= strmov(buf, "host=");
@@ -6734,7 +6754,7 @@ void Create_file_log_event::print(FILE* file, PRINT_EVENT_INFO* print_event_info
 */
 
 #if defined(HAVE_REPLICATION) && !defined(MYSQL_CLIENT)
-void Create_file_log_event::pack_info(Protocol *protocol)
+void Create_file_log_event::pack_info(THD *thd, Protocol *protocol)
 {
   char buf[SAFE_NAME_LEN*2 + 30 + 21*2], *pos;
   pos= strmov(buf, "db=");
@@ -6916,7 +6936,7 @@ void Append_block_log_event::print(FILE* file,
 */
 
 #if defined(HAVE_REPLICATION) && !defined(MYSQL_CLIENT)
-void Append_block_log_event::pack_info(Protocol *protocol)
+void Append_block_log_event::pack_info(THD *thd, Protocol *protocol)
 {
   char buf[256];
   uint length;
@@ -7069,7 +7089,7 @@ void Delete_file_log_event::print(FILE* file,
 */
 
 #if defined(HAVE_REPLICATION) && !defined(MYSQL_CLIENT)
-void Delete_file_log_event::pack_info(Protocol *protocol)
+void Delete_file_log_event::pack_info(THD *thd, Protocol *protocol)
 {
   char buf[64];
   uint length;
@@ -7168,7 +7188,7 @@ void Execute_load_log_event::print(FILE* file,
 */
 
 #if defined(HAVE_REPLICATION) && !defined(MYSQL_CLIENT)
-void Execute_load_log_event::pack_info(Protocol *protocol)
+void Execute_load_log_event::pack_info(THD *thd, Protocol *protocol)
 {
   char buf[64];
   uint length;
@@ -7422,27 +7442,26 @@ void Execute_load_query_log_event::print(FILE* file,
 
 
 #if defined(HAVE_REPLICATION) && !defined(MYSQL_CLIENT)
-void Execute_load_query_log_event::pack_info(Protocol *protocol)
+void Execute_load_query_log_event::pack_info(THD *thd, Protocol *protocol)
 {
-  char *buf, *pos;
-  if (!(buf= (char*) my_malloc(9 + db_len + q_len + 10 + 21, MYF(MY_WME))))
-    return;
-  pos= buf;
+  char buf_mem[1024];
+  char file_id_buf[22];
+  String buf(buf_mem, sizeof(buf_mem), system_charset_info);
+  buf.real_alloc(9 + db_len + q_len + 10 + 21);
   if (db && db_len)
   {
-    pos= strmov(buf, "use `");
-    memcpy(pos, db, db_len);
-    pos= strmov(pos+db_len, "`; ");
-  }
-  if (query && q_len)
-  {
-    memcpy(pos, query, q_len);
-    pos+= q_len;
+    if (buf.append("use ") ||
+        append_identifier(thd, &buf, db, db_len) ||
+        buf.append("; "))
+      return;
   }
-  pos= strmov(pos, " ;file_id=");
-  pos= int10_to_str((long) file_id, pos, 10);
-  protocol->store(buf, pos-buf, &my_charset_bin);
-  my_free(buf, MYF(MY_ALLOW_ZERO_PTR));
+  if (query && q_len && buf.append(query, q_len))
+    return;
+  int10_to_str((long) file_id, file_id_buf, 10);
+  if (buf.append(" ;file_id=") ||
+      buf.append(file_id_buf))
+    return;
+  protocol->store(buf.ptr(), buf.length(), &my_charset_bin);
 }
 
 
@@ -8386,7 +8405,7 @@ bool Rows_log_event::write_data_body(IO_CACHE*file)
 #endif
 
 #if defined(HAVE_REPLICATION) && !defined(MYSQL_CLIENT)
-void Rows_log_event::pack_info(Protocol *protocol)
+void Rows_log_event::pack_info(THD *thd, Protocol *protocol)
 {
   char buf[256];
   char const *const flagstr=
@@ -8488,7 +8507,7 @@ bool Annotate_rows_log_event::write_data_body(IO_CACHE *file)
 #endif
 
 #if !defined(MYSQL_CLIENT) && defined(HAVE_REPLICATION)
-void Annotate_rows_log_event::pack_info(Protocol* protocol)
+void Annotate_rows_log_event::pack_info(THD *thd, Protocol* protocol)
 {
   if (m_query_txt && m_query_len)
     protocol->store(m_query_txt, m_query_len, &my_charset_bin);
@@ -9230,7 +9249,7 @@ bool Table_map_log_event::write_data_body(IO_CACHE *file)
  */
 
 #if defined(HAVE_REPLICATION) && !defined(MYSQL_CLIENT)
-void Table_map_log_event::pack_info(Protocol *protocol)
+void Table_map_log_event::pack_info(THD *thd, Protocol *protocol)
 {
     char buf[256];
     size_t bytes= my_snprintf(buf, sizeof(buf),
@@ -9251,7 +9270,7 @@ void Table_map_log_event::print(FILE *, PRINT_EVENT_INFO *print_event_info)
   {
     print_header(&print_event_info->head_cache, print_event_info, TRUE);
     my_b_printf(&print_event_info->head_cache,
-                "\tTable_map: `%s`.`%s` mapped to number %lu\n",
+                "\tTable_map: %`s.%`s mapped to number %lu\n",
                 m_dbnam, m_tblnam, m_table_id);
     print_base64(&print_event_info->body_cache, print_event_info, TRUE);
   }
@@ -10531,7 +10550,7 @@ Incident_log_event::description() const
 
 
 #ifndef MYSQL_CLIENT
-void Incident_log_event::pack_info(Protocol *protocol)
+void Incident_log_event::pack_info(THD *thd, Protocol *protocol)
 {
   char buf[256];
   size_t bytes;
diff --git a/sql/log_event.h b/sql/log_event.h
index 1ce17bd7e35..a913e40d721 100644
--- a/sql/log_event.h
+++ b/sql/log_event.h
@@ -1008,14 +1008,15 @@ public:
   */
   static void init_show_field_list(List<Item>* field_list);
 #ifdef HAVE_REPLICATION
-  int net_send(Protocol *protocol, const char* log_name, my_off_t pos);
+  int net_send(THD *thd, Protocol *protocol, const char* log_name,
+               my_off_t pos);
 
   /*
     pack_info() is used by SHOW BINLOG EVENTS; as print() it prepares and sends
     a string to display to the user, so it resembles print().
   */
 
-  virtual void pack_info(Protocol *protocol);
+  virtual void pack_info(THD *thd, Protocol *protocol);
 
 #endif /* HAVE_REPLICATION */
   virtual const char* get_db()
@@ -1741,7 +1742,7 @@ public:
                   bool using_trans, bool suppress_use, int error);
   const char* get_db() { return db; }
 #ifdef HAVE_REPLICATION
-  void pack_info(Protocol* protocol);
+  void pack_info(THD *thd, Protocol* protocol);
 #endif /* HAVE_REPLICATION */
 #else
   void print_query_header(IO_CACHE* file, PRINT_EVENT_INFO* print_event_info);
@@ -1871,7 +1872,7 @@ public:
 
 #ifndef MYSQL_CLIENT
   Slave_log_event(THD* thd_arg, Relay_log_info* rli);
-  void pack_info(Protocol* protocol);
+  void pack_info(THD *thd, Protocol* protocol);
 #else
   void print(FILE* file, PRINT_EVENT_INFO* print_event_info);
 #endif
@@ -2104,9 +2105,11 @@ protected:
                      const Format_description_log_event* description_event);
 
 public:
-  uint get_query_buffer_length();
-  void print_query(bool need_db, const char *cs, char *buf, char **end,
-                   char **fn_start, char **fn_end);
+#ifndef MYSQL_CLIENT
+  void print_query(THD *thd, bool need_db, const char *cs, String *buf,
+                   my_off_t *fn_start, my_off_t *fn_end,
+                   const char *qualify_db);
+#endif
   ulong thread_id;
   ulong slave_proxy_id;
   uint32 table_name_len;
@@ -2154,7 +2157,7 @@ public:
                   Name_resolution_context *context);
   const char* get_db() { return db; }
 #ifdef HAVE_REPLICATION
-  void pack_info(Protocol* protocol);
+  void pack_info(THD *thd, Protocol* protocol);
 #endif /* HAVE_REPLICATION */
 #else
   void print(FILE* file, PRINT_EVENT_INFO* print_event_info);
@@ -2253,7 +2256,7 @@ public:
 #ifndef MYSQL_CLIENT
   Start_log_event_v3();
 #ifdef HAVE_REPLICATION
-  void pack_info(Protocol* protocol);
+  void pack_info(THD *thd, Protocol* protocol);
 #endif /* HAVE_REPLICATION */
 #else
   Start_log_event_v3() {}
@@ -2414,7 +2417,7 @@ public:
     :Log_event(thd_arg,0,0), val(val_arg), type(type_arg)
   { cache_type= cache_type_arg; }
 #ifdef HAVE_REPLICATION
-  void pack_info(Protocol* protocol);
+  void pack_info(THD *thd, Protocol* protocol);
 #endif /* HAVE_REPLICATION */
 #else
   void print(FILE* file, PRINT_EVENT_INFO* print_event_info);
@@ -2491,7 +2494,7 @@ class Rand_log_event: public Log_event
     :Log_event(thd_arg, 0, 0), seed1(seed1_arg), seed2(seed2_arg)
     { cache_type= cache_type_arg; }
 #ifdef HAVE_REPLICATION
-  void pack_info(Protocol* protocol);
+  void pack_info(THD *thd, Protocol* protocol);
 #endif /* HAVE_REPLICATION */
 #else
   void print(FILE* file, PRINT_EVENT_INFO* print_event_info);
@@ -2536,7 +2539,7 @@ class Xid_log_event: public Log_event
   Xid_log_event(THD* thd_arg, my_xid x): Log_event(thd_arg, 0, 0), xid(x)
   { cache_type= EVENT_NO_CACHE; }
 #ifdef HAVE_REPLICATION
-  void pack_info(Protocol* protocol);
+  void pack_info(THD *thd, Protocol* protocol);
 #endif /* HAVE_REPLICATION */
 #else
   void print(FILE* file, PRINT_EVENT_INFO* print_event_info);
@@ -2586,7 +2589,7 @@ public:
     :Log_event(thd_arg, 0, 0), name(name_arg), name_len(name_len_arg), val(val_arg),
      val_len(val_len_arg), type(type_arg), charset_number(charset_number_arg)
     { is_null= !val; cache_type= cache_type_arg; }
-  void pack_info(Protocol* protocol);
+  void pack_info(THD *thd, Protocol* protocol);
 #else
   void print(FILE* file, PRINT_EVENT_INFO* print_event_info);
 #endif
@@ -2717,7 +2720,7 @@ public:
 		   uint ident_len_arg,
 		   ulonglong pos_arg, uint flags);
 #ifdef HAVE_REPLICATION
-  void pack_info(Protocol* protocol);
+  void pack_info(THD *thd, Protocol* protocol);
 #endif /* HAVE_REPLICATION */
 #else
   void print(FILE* file, PRINT_EVENT_INFO* print_event_info);
@@ -2777,7 +2780,7 @@ public:
 			uchar* block_arg, uint block_len_arg,
 			bool using_trans);
 #ifdef HAVE_REPLICATION
-  void pack_info(Protocol* protocol);
+  void pack_info(THD *thd, Protocol* protocol);
 #endif /* HAVE_REPLICATION */
 #else
   void print(FILE* file, PRINT_EVENT_INFO* print_event_info);
@@ -2849,7 +2852,7 @@ public:
   Append_block_log_event(THD* thd, const char* db_arg, uchar* block_arg,
 			 uint block_len_arg, bool using_trans);
 #ifdef HAVE_REPLICATION
-  void pack_info(Protocol* protocol);
+  void pack_info(THD *thd, Protocol* protocol);
   virtual int get_create_or_append() const;
 #endif /* HAVE_REPLICATION */
 #else
@@ -2890,7 +2893,7 @@ public:
 #ifndef MYSQL_CLIENT
   Delete_file_log_event(THD* thd, const char* db_arg, bool using_trans);
 #ifdef HAVE_REPLICATION
-  void pack_info(Protocol* protocol);
+  void pack_info(THD *thd, Protocol* protocol);
 #endif /* HAVE_REPLICATION */
 #else
   void print(FILE* file, PRINT_EVENT_INFO* print_event_info);
@@ -2931,7 +2934,7 @@ public:
 #ifndef MYSQL_CLIENT
   Execute_load_log_event(THD* thd, const char* db_arg, bool using_trans);
 #ifdef HAVE_REPLICATION
-  void pack_info(Protocol* protocol);
+  void pack_info(THD *thd, Protocol* protocol);
 #endif /* HAVE_REPLICATION */
 #else
   void print(FILE* file, PRINT_EVENT_INFO* print_event_info);
@@ -3027,7 +3030,7 @@ public:
                                bool using_trans, bool suppress_use,
                                int errcode);
 #ifdef HAVE_REPLICATION
-  void pack_info(Protocol* protocol);
+  void pack_info(THD *thd, Protocol* protocol);
 #endif /* HAVE_REPLICATION */
 #else
   void print(FILE* file, PRINT_EVENT_INFO* print_event_info);
@@ -3113,7 +3116,7 @@ public:
 #endif
 
 #if !defined(MYSQL_CLIENT) && defined(HAVE_REPLICATION)
-  virtual void pack_info(Protocol*);
+  virtual void pack_info(THD *thd, Protocol*);
 #endif
 
 #ifdef MYSQL_CLIENT
@@ -3527,7 +3530,7 @@ public:
 #endif
 
 #if !defined(MYSQL_CLIENT) && defined(HAVE_REPLICATION)
-  virtual void pack_info(Protocol *protocol);
+  virtual void pack_info(THD *thd, Protocol *protocol);
 #endif
 
 #ifdef MYSQL_CLIENT
@@ -3639,7 +3642,7 @@ public:
   flag_set get_flags(flag_set flags_arg) const { return m_flags & flags_arg; }
 
 #if !defined(MYSQL_CLIENT) && defined(HAVE_REPLICATION)
-  virtual void pack_info(Protocol *protocol);
+  virtual void pack_info(THD *thd, Protocol *protocol);
 #endif
 
 #ifdef MYSQL_CLIENT
@@ -4080,7 +4083,7 @@ public:
 #endif
 
 #ifndef MYSQL_CLIENT
-  void pack_info(Protocol*);
+  void pack_info(THD *thd, Protocol*);
 #endif
 
   Incident_log_event(const char *buf, uint event_len,
diff --git a/sql/log_event_old.cc b/sql/log_event_old.cc
index 7328d3451f1..f29a2ed9ad6 100644
--- a/sql/log_event_old.cc
+++ b/sql/log_event_old.cc
@@ -2012,7 +2012,7 @@ bool Old_rows_log_event::write_data_body(IO_CACHE*file)
 
 
 #if defined(HAVE_REPLICATION) && !defined(MYSQL_CLIENT)
-void Old_rows_log_event::pack_info(Protocol *protocol)
+void Old_rows_log_event::pack_info(THD *thd, Protocol *protocol)
 {
   char buf[256];
   char const *const flagstr=
diff --git a/sql/log_event_old.h b/sql/log_event_old.h
index 8fe2e9e0a75..3e1efd8e2c0 100644
--- a/sql/log_event_old.h
+++ b/sql/log_event_old.h
@@ -108,7 +108,7 @@ public:
   flag_set get_flags(flag_set flags_arg) const { return m_flags & flags_arg; }
 
 #if !defined(MYSQL_CLIENT) && defined(HAVE_REPLICATION)
-  virtual void pack_info(Protocol *protocol);
+  virtual void pack_info(THD *thd, Protocol *protocol);
 #endif
 
 #ifdef MYSQL_CLIENT
diff --git a/sql/mysql_priv.h b/sql/mysql_priv.h
index 815983122ef..ab4bc87e013 100644
--- a/sql/mysql_priv.h
+++ b/sql/mysql_priv.h
@@ -1549,7 +1549,7 @@ bool append_escaped(String *to_str, String *from_str);
 /* sql_show.cc */
 bool mysqld_show_open_tables(THD *thd,const char *wild);
 bool mysqld_show_logs(THD *thd);
-void append_identifier(THD *thd, String *packet, const char *name,
+bool append_identifier(THD *thd, String *packet, const char *name,
 		       uint length);
 #endif /* MYSQL_SERVER */
 #if defined MYSQL_SERVER || defined INNODB_COMPATIBILITY_HOOKS
diff --git a/sql/sql_base.cc b/sql/sql_base.cc
index b8db5a581fd..50606ad5f55 100644
--- a/sql/sql_base.cc
+++ b/sql/sql_base.cc
@@ -4254,22 +4254,22 @@ retry:
     entry->file->implicit_emptied= 0;
     if (mysql_bin_log.is_open())
     {
-      char *query, *end;
-      uint query_buf_size= 20 + share->db.length + share->table_name.length +1;
-      if ((query= (char*) my_malloc(query_buf_size,MYF(MY_WME))))
+      char query_buf[2*FN_REFLEN + 21];
+      String query(query_buf, sizeof(query_buf), system_charset_info);
+      query.length(0);
+      if (query.ptr())
       {
         /* this DELETE FROM is needed even with row-based binlogging */
-        end = strxmov(strmov(query, "DELETE FROM `"),
-                      share->db.str,"`.`",share->table_name.str,"`", NullS);
+        query.append("DELETE FROM ");
+        append_identifier(thd, &query, share->db.str, share->db.length);
+        query.append(".");
+        append_identifier(thd, &query, share->table_name.str,
+                          share->table_name.length);
         int errcode= query_error_code(thd, TRUE);
         if (thd->binlog_query(THD::STMT_QUERY_TYPE,
-                              query, (ulong)(end-query),
+                              query.ptr(), query.length(),
                               FALSE, FALSE, errcode))
-        {
-          my_free(query, MYF(0));
           goto err;
-        }
-        my_free(query, MYF(0));
       }
       else
       {
@@ -4279,7 +4279,7 @@ retry:
           because of MYF(MY_WME) in my_malloc() above).
         */
         sql_print_error("When opening HEAP table, could not allocate memory "
-                        "to write 'DELETE FROM `%s`.`%s`' to the binary log",
+                        "to write 'DELETE FROM %`s.%`s' to the binary log",
                         table_list->db, table_list->table_name);
         delete entry->triggers;
         closefrm(entry, 0);
diff --git a/sql/sql_db.cc b/sql/sql_db.cc
index 07dd1984d80..0b5f6257717 100644
--- a/sql/sql_db.cc
+++ b/sql/sql_db.cc
@@ -614,7 +614,6 @@ int mysql_create_db(THD *thd, char *db, HA_CREATE_INFO *create_info,
                      bool silent)
 {
   char	 path[FN_REFLEN+16];
-  char	 tmp_query[FN_REFLEN+16];
   long result= 1;
   int error= 0;
   MY_STAT stat_info;
@@ -721,17 +720,9 @@ not_silent:
     char *query;
     uint query_length;
 
-    if (!thd->query())                          // Only in replication
-    {
-      query= 	     tmp_query;
-      query_length= (uint) (strxmov(tmp_query,"create database `",
-                                    db, "`", NullS) - tmp_query);
-    }
-    else
-    {
-      query=        thd->query();
-      query_length= thd->query_length();
-    }
+    query=        thd->query();
+    query_length= thd->query_length();
+    DBUG_ASSERT(query);
 
     ha_binlog_log_query(thd, 0, LOGCOM_CREATE_DB,
                         query, query_length,
@@ -991,18 +982,11 @@ bool mysql_rm_db(THD *thd,char *db,bool if_exists, bool silent)
   {
     const char *query;
     ulong query_length;
-    if (!thd->query())
-    {
-      /* The client used the old obsolete mysql_drop_db() call */
-      query= path;
-      query_length= (uint) (strxmov(path, "drop database `", db, "`",
-                                     NullS) - path);
-    }
-    else
-    {
-      query= thd->query();
-      query_length= thd->query_length();
-    }
+
+    query= thd->query();
+    query_length= thd->query_length();
+    DBUG_ASSERT(query);
+
     if (mysql_bin_log.is_open())
     {
       thd->clear_error();
@@ -1043,9 +1027,10 @@ bool mysql_rm_db(THD *thd,char *db,bool if_exists, bool silent)
     for (tbl= dropped_tables; tbl; tbl= tbl->next_local)
     {
       uint tbl_name_len;
+      char quoted_name[FN_REFLEN+3];
 
-      /* 3 for the quotes and the comma*/
-      tbl_name_len= strlen(tbl->table_name) + 3;
+      my_snprintf(quoted_name, sizeof(quoted_name), "%`s", tbl->table_name);
+      tbl_name_len= strlen(quoted_name) + 1; /* +1 for the comma */
       if (query_pos + tbl_name_len + 1 >= query_end)
       {
         /* These DDL methods and logging protected with LOCK_mysql_create_db */
@@ -1057,9 +1042,7 @@ bool mysql_rm_db(THD *thd,char *db,bool if_exists, bool silent)
         query_pos= query_data_start;
       }
 
-      *query_pos++ = '`';
-      query_pos= strmov(query_pos,tbl->table_name);
-      *query_pos++ = '`';
+      query_pos= strmov(query_pos, quoted_name);
       *query_pos++ = ',';
     }
 
diff --git a/sql/sql_insert.cc b/sql/sql_insert.cc
index a4943d5e13a..9f26d0c4a09 100644
--- a/sql/sql_insert.cc
+++ b/sql/sql_insert.cc
@@ -3543,16 +3543,16 @@ int select_create::write_to_binlog(bool is_trans, int errcode)
     if (thd->lex->create_select_in_comment)
       query.append(STRING_WITH_LEN("/*! "));
     if (thd->lex->ignore)
-      query.append(STRING_WITH_LEN("INSERT IGNORE INTO `"));
+      query.append(STRING_WITH_LEN("INSERT IGNORE INTO "));
     else if (thd->lex->duplicates == DUP_REPLACE)
-      query.append(STRING_WITH_LEN("REPLACE INTO `"));
+      query.append(STRING_WITH_LEN("REPLACE INTO "));
     else
-      query.append(STRING_WITH_LEN("INSERT INTO `"));
+      query.append(STRING_WITH_LEN("INSERT INTO "));
 
-    query.append(create_table->db, db_len);
-    query.append(STRING_WITH_LEN("`.`"));
-    query.append(create_info->alias, table_len);
-    query.append(STRING_WITH_LEN("` "));
+    append_identifier(thd, &query, create_table->db, db_len);
+    query.append(STRING_WITH_LEN("."));
+    append_identifier(thd, &query, create_info->alias, table_len);
+    query.append(STRING_WITH_LEN(" "));
 
     /*
       The insert items.
diff --git a/sql/sql_load.cc b/sql/sql_load.cc
index 7fcb52a7b9c..9eef9ece13f 100644
--- a/sql/sql_load.cc
+++ b/sql/sql_load.cc
@@ -24,6 +24,7 @@
 #include "sql_repl.h"
 #include "sp_head.h"
 #include "sql_trigger.h"
+#include "sql_show.h"
 
 class READ_INFO {
   File	file;
@@ -615,24 +616,31 @@ static bool write_execute_load_query_log_event(THD *thd, sql_exchange* ex,
                                                bool transactional_table,
                                                int errcode)
 {
-  char                *load_data_query,
-                      *end,
-                      *fname_start,
-                      *fname_end,
-                      *p= NULL;
-  size_t               pl= 0;
+  char                *load_data_query;
+  my_off_t            fname_start,
+                      fname_end;
   List<Item>           fv;
   Item                *item, *val;
   int                  n;
-  const char          *tbl= table_name_arg;
   const char          *tdb= (thd->db != NULL ? thd->db : db_arg);
+  const char          *qualify_db= NULL;
   char 		      name_buffer[SAFE_NAME_LEN*2];
   char                command_buffer[1024];
   String              string_buf(name_buffer, sizeof(name_buffer),
                                  system_charset_info);
-  String              pfields(command_buffer, sizeof(command_buffer),
+  String              query_str(command_buffer, sizeof(command_buffer),
                               system_charset_info);
 
+  Load_log_event       lle(thd, ex, tdb, table_name_arg, fv, duplicates,
+                           ignore, transactional_table);
+
+  /*
+    force in a LOCAL if there was one in the original.
+  */
+  if (thd->lex->local_file)
+    lle.set_fname_outside_temp_buf(ex->file_name, strlen(ex->file_name));
+
+  query_str.length(0);
   if (!thd->db || strcmp(db_arg, thd->db)) 
   {
     /*
@@ -640,49 +648,31 @@ static bool write_execute_load_query_log_event(THD *thd, sql_exchange* ex,
       prefix table name with database name so that it 
       becomes a FQ name.
      */
-    string_buf.length(0);
-    string_buf.append(db_arg);
-    string_buf.append("`");
-    string_buf.append(".");
-    string_buf.append("`");
-    string_buf.append(table_name_arg);
-    tbl= string_buf.c_ptr_safe();
+    qualify_db= db_arg;
   }
-
-  Load_log_event       lle(thd, ex, tdb, tbl, fv, duplicates,
-                           ignore, transactional_table);
-
-  /*
-    force in a LOCAL if there was one in the original.
-  */
-  if (thd->lex->local_file)
-    lle.set_fname_outside_temp_buf(ex->file_name, strlen(ex->file_name));
+  lle.print_query(thd, FALSE, (const char *) ex->cs?ex->cs->csname:NULL,
+                  &query_str, &fname_start, &fname_end, qualify_db);
 
   /*
     prepare fields-list and SET if needed; print_query won't do that for us.
   */
-  pfields.length(0);
   if (!thd->lex->field_list.is_empty())
   {
     List_iterator<Item>  li(thd->lex->field_list);
 
-    pfields.append(" (");
+    query_str.append(" (");
     n= 0;
 
     while ((item= li++))
     {
       if (n++)
-        pfields.append(", ");
+        query_str.append(", ");
       if (item->name)
-      {
-        pfields.append("`");
-        pfields.append(item->name);
-        pfields.append("`");
-      }
+        append_identifier(thd, &query_str, item->name, strlen(item->name));
       else
-        item->print(&pfields, QT_ORDINARY);
+        ((Item_user_var_as_out_param *)item)->print_for_load(thd, &query_str);
     }
-    pfields.append(")");
+    query_str.append(")");
   }
 
   if (!thd->lex->update_list.is_empty())
@@ -690,39 +680,26 @@ static bool write_execute_load_query_log_event(THD *thd, sql_exchange* ex,
     List_iterator<Item> lu(thd->lex->update_list);
     List_iterator<Item> lv(thd->lex->value_list);
 
-    pfields.append(" SET ");
+    query_str.append(" SET ");
     n= 0;
 
     while ((item= lu++))
     {
       val= lv++;
       if (n++)
-        pfields.append(", ");
-      pfields.append("`");
-      pfields.append(item->name);
-      pfields.append("`");
-      pfields.append("=");
-      val->print(&pfields, QT_ORDINARY);
+        query_str.append(", ");
+      append_identifier(thd, &query_str, item->name, strlen(item->name));
+      query_str.append("=");
+      val->print(&query_str, QT_ORDINARY);
     }
   }
 
-  p=  pfields.c_ptr_safe();
-  pl= pfields.length();
-
-  if (!(load_data_query= (char *)thd->alloc(lle.get_query_buffer_length() + 1 + pl)))
+  if (!(load_data_query= (char *)thd->strmake(query_str.ptr(), query_str.length())))
     return TRUE;
 
-  lle.print_query(FALSE, (const char *) ex->cs?ex->cs->csname:NULL,
-                  load_data_query, &end,
-                  (char **)&fname_start, (char **)&fname_end);
-
-  strcpy(end, p);
-  end += pl;
-
   Execute_load_query_log_event
-    e(thd, load_data_query, end-load_data_query,
-      (uint) ((char*) fname_start - load_data_query - 1),
-      (uint) ((char*) fname_end - load_data_query),
+    e(thd, load_data_query, query_str.length(),
+      (uint) (fname_start - 1), (uint) fname_end,
       (duplicates == DUP_REPLACE) ? LOAD_DUP_REPLACE :
       (ignore ? LOAD_DUP_IGNORE : LOAD_DUP_ERROR),
       transactional_table, FALSE, errcode);
diff --git a/sql/sql_repl.cc b/sql/sql_repl.cc
index 8245bbe48f1..77ae5290a3f 100644
--- a/sql/sql_repl.cc
+++ b/sql/sql_repl.cc
@@ -1721,7 +1721,7 @@ bool mysql_show_binlog_events(THD* thd)
         description_event->checksum_alg= ev->checksum_alg;
 
       if (event_count >= limit_start &&
-	  ev->net_send(protocol, linfo.log_file_name, pos))
+	  ev->net_send(thd, protocol, linfo.log_file_name, pos))
       {
 	errmsg = "Net error";
 	delete ev;
diff --git a/sql/sql_show.cc b/sql/sql_show.cc
index 5a1739369d7..0a23a95bbcf 100644
--- a/sql/sql_show.cc
+++ b/sql/sql_show.cc
@@ -1053,9 +1053,13 @@ static const char *require_quotes(const char *name, uint name_length)
   packet                target string
   name                  the identifier to be appended
   name_length           length of the appending identifier
+
+  RETURN VALUES
+    true                Error
+    false               Ok
 */
 
-void
+bool
 append_identifier(THD *thd, String *packet, const char *name, uint length)
 {
   const char *name_end;
@@ -1063,10 +1067,7 @@ append_identifier(THD *thd, String *packet, const char *name, uint length)
   int q= get_quote_char_for_identifier(thd, name, length);
 
   if (q == EOF)
-  {
-    packet->append(name, length, packet->charset());
-    return;
-  }
+    return packet->append(name, length, packet->charset());
 
   /*
     The identifier must be quoted as it includes a quote character or
@@ -1075,7 +1076,8 @@ append_identifier(THD *thd, String *packet, const char *name, uint length)
 
   VOID(packet->reserve(length*2 + 2));
   quote_char= (char) q;
-  packet->append(&quote_char, 1, system_charset_info);
+  if (packet->append(&quote_char, 1, system_charset_info))
+    return true;
 
   for (name_end= name+length ; name < name_end ; name+= length)
   {
@@ -1090,11 +1092,13 @@ append_identifier(THD *thd, String *packet, const char *name, uint length)
     */
     if (!length)
       length= 1;
-    if (length == 1 && chr == (uchar) quote_char)
-      packet->append(&quote_char, 1, system_charset_info);
-    packet->append(name, length, system_charset_info);
+    if (length == 1 && chr == (uchar) quote_char &&
+        packet->append(&quote_char, 1, system_charset_info))
+      return true;
+    if (packet->append(name, length, system_charset_info))
+      return true;
   }
-  packet->append(&quote_char, 1, system_charset_info);
+  return packet->append(&quote_char, 1, system_charset_info);
 }
 
 
diff --git a/sql/sql_string.cc b/sql/sql_string.cc
index 57a308f581d..5941022546c 100644
--- a/sql/sql_string.cc
+++ b/sql/sql_string.cc
@@ -1159,39 +1159,47 @@ outp:
 
 
 
-
-void String::print(String *str)
+/*
+  Append characters to a single-quoted string '...', escaping special
+  characters as necessary.
+  Does not add the enclosing quotes, this is left up to caller.
+*/
+void String::append_for_single_quote(const char *st, uint len)
 {
-  char *st= (char*)Ptr, *end= st+str_length;
+  const char *end= st+len;
   for (; st < end; st++)
   {
     uchar c= *st;
     switch (c)
     {
     case '\\':
-      str->append(STRING_WITH_LEN("\\\\"));
+      append(STRING_WITH_LEN("\\\\"));
       break;
     case '\0':
-      str->append(STRING_WITH_LEN("\\0"));
+      append(STRING_WITH_LEN("\\0"));
       break;
     case '\'':
-      str->append(STRING_WITH_LEN("\\'"));
+      append(STRING_WITH_LEN("\\'"));
       break;
     case '\n':
-      str->append(STRING_WITH_LEN("\\n"));
+      append(STRING_WITH_LEN("\\n"));
       break;
     case '\r':
-      str->append(STRING_WITH_LEN("\\r"));
+      append(STRING_WITH_LEN("\\r"));
       break;
     case '\032': // Ctrl-Z
-      str->append(STRING_WITH_LEN("\\Z"));
+      append(STRING_WITH_LEN("\\Z"));
       break;
     default:
-      str->append(c);
+      append(c);
     }
   }
 }
 
+void String::print(String *str)
+{
+  str->append_for_single_quote(Ptr, str_length);
+}
 
 /*
   Exchange state of this object and argument.
diff --git a/sql/sql_string.h b/sql/sql_string.h
index ba90c8140df..9e596866de1 100644
--- a/sql/sql_string.h
+++ b/sql/sql_string.h
@@ -438,6 +438,7 @@ public:
     return FALSE;
   }
   void print(String *print);
+  void append_for_single_quote(const char *st, uint len);
 
   /* Swap two string objects. Efficient way to exchange data without memcpy. */
   void swap(String &s);
diff --git a/sql/sql_table.cc b/sql/sql_table.cc
index 1b9ec320f7e..7f5df6a0958 100644
--- a/sql/sql_table.cc
+++ b/sql/sql_table.cc
@@ -1939,6 +1939,7 @@ int mysql_rm_table_part2(THD *thd, TABLE_LIST *tables, bool if_exists,
   for (table= tables; table; table= table->next_local)
   {
     char *db=table->db;
+    size_t db_length= table->db_length;
     handlerton *table_type;
     enum legacy_db_type frm_db_type= DB_TYPE_UNKNOWN;
 
@@ -1961,14 +1962,14 @@ int mysql_rm_table_part2(THD *thd, TABLE_LIST *tables, bool if_exists,
           built_tmp_query.append("DROP TEMPORARY TABLE IF EXISTS ");
         }
 
-        built_tmp_query.append("`");
         if (thd->db == NULL || strcmp(db,thd->db) != 0)
         {
-          built_tmp_query.append(db);
-          built_tmp_query.append("`.`");
+          append_identifier(thd, &built_tmp_query, db, db_length);
+          built_tmp_query.append(".");
         }
-        built_tmp_query.append(table->table_name);
-        built_tmp_query.append("`,");
+        append_identifier(thd, &built_tmp_query, table->table_name,
+                          table->table_name_length);
+        built_tmp_query.append(",");
       }
 
       continue;
@@ -1994,15 +1995,15 @@ int mysql_rm_table_part2(THD *thd, TABLE_LIST *tables, bool if_exists,
         Don't write the database name if it is the current one (or if
         thd->db is NULL).
       */
-      built_query.append("`");
       if (thd->db == NULL || strcmp(db,thd->db) != 0)
       {
-        built_query.append(db);
-        built_query.append("`.`");
+        append_identifier(thd, &built_query, db, db_length);
+        built_query.append(".");
       }
 
-      built_query.append(table->table_name);
-      built_query.append("`,");
+      append_identifier(thd, &built_query, table->table_name,
+                        table->table_name_length);
+      built_query.append(",");
     }
 
     if (!drop_temporary)