From e689473cea5f078065ef31b357819f11bfc079d1 Mon Sep 17 00:00:00 2001
From: Noriko Hosoi <nhosoi@totoro.usersys.redhat.com>
Date: Tue, 17 Apr 2012 17:01:34 -0700
Subject: [PATCH] Trac Ticket #310 - Avoid calling escape_string() for logged
 DNs

https://fedorahosted.org/389/ticket/310

Fix description: removed unnecessary escape_string calls and the
static buffer used by escape_string.
---
 ldap/servers/plugins/acl/acl.c                     |   38 +++-----
 ldap/servers/plugins/acl/aclanom.c                 |   11 +-
 ldap/servers/plugins/acl/acllas.c                  |    2 +-
 ldap/servers/plugins/acl/aclutil.c                 |    7 +-
 ldap/servers/plugins/chainingdb/cb_config.c        |    7 +-
 ldap/servers/plugins/cos/cos_cache.c               |    5 +-
 ldap/servers/plugins/pam_passthru/pam_ptimpl.c     |   35 +++----
 ldap/servers/plugins/replication/repl5_replica.c   |  104 ++++++++------------
 .../plugins/replication/repl5_replica_config.c     |    9 +-
 ldap/servers/plugins/replication/replutil.c        |    3 +-
 ldap/servers/plugins/replication/urp.c             |    5 +-
 ldap/servers/plugins/replication/urp_glue.c        |    5 +-
 .../plugins/replication/windows_connection.c       |    3 +-
 .../plugins/replication/windows_protocol_util.c    |   14 +--
 ldap/servers/plugins/views/views.c                 |    9 +-
 ldap/servers/slapd/add.c                           |    9 +-
 ldap/servers/slapd/attr.c                          |    3 +-
 ldap/servers/slapd/auth.c                          |   38 ++++----
 ldap/servers/slapd/back-ldbm/import-threads.c      |   21 ++---
 ldap/servers/slapd/back-ldbm/ldbm_modrdn.c         |   15 +--
 ldap/servers/slapd/back-ldbm/ldbm_search.c         |   11 +--
 ldap/servers/slapd/back-ldbm/vlv.c                 |    3 +-
 ldap/servers/slapd/bind.c                          |   13 +--
 ldap/servers/slapd/compare.c                       |    4 +-
 ldap/servers/slapd/configdse.c                     |    4 +-
 ldap/servers/slapd/delete.c                        |    5 +-
 ldap/servers/slapd/entry.c                         |   15 ++--
 ldap/servers/slapd/modify.c                        |   22 ++---
 ldap/servers/slapd/modrdn.c                        |   19 ++--
 ldap/servers/slapd/opshared.c                      |   15 +--
 ldap/servers/slapd/psearch.c                       |    3 +-
 ldap/servers/slapd/pw.c                            |    6 +-
 ldap/servers/slapd/resourcelimit.c                 |    4 +-
 ldap/servers/slapd/result.c                        |    5 +-
 ldap/servers/slapd/sasl_map.c                      |    2 +-
 ldap/servers/slapd/schema.c                        |   29 ++----
 ldap/servers/slapd/search.c                        |    3 +-
 37 files changed, 199 insertions(+), 307 deletions(-)

diff --git a/ldap/servers/plugins/acl/acl.c b/ldap/servers/plugins/acl/acl.c
index 5a7b446..15e474e 100644
--- a/ldap/servers/plugins/acl/acl.c
+++ b/ldap/servers/plugins/acl/acl.c
@@ -187,10 +187,8 @@ static int check_rdn_access( Slapi_PBlock *pb, Slapi_Entry *e, const char *dn,
 				struct berval bv;
 			
 				if ( slapi_rdn2typeval( rdns[i], &type, &bv ) != 0 ) {
-        			char ebuf[ BUFSIZ ];
         			slapi_log_error( SLAPI_LOG_ACL, plugin_name,
-							"modrdn: rdn2typeval (%s) failed\n",
-							 escape_string( rdns[i], ebuf ));
+							"modrdn: rdn2typeval (%s) failed\n", rdns[i]);
 					retCode = LDAP_INSUFFICIENT_ACCESS;
 					break;            	
 				} else {
@@ -254,7 +252,6 @@ acl_access_allowed(
 	AclAttrEval			*c_attrEval = NULL;
 	int					got_reader_locked = 0;
 	int					deallocate_attrEval = 0;
-	char				ebuf [ BUFSIZ ];
 	char				*clientDn;
 	Slapi_DN			*e_sdn;
 	Slapi_Operation		*op = NULL;
@@ -307,7 +304,7 @@ acl_access_allowed(
 				": readonly backend\n",
 				 op->o_connid, op->o_opid,
 				acl_access2str(access),
-				escape_string_with_punctuation(n_edn,ebuf));
+				n_edn);
 			return LDAP_UNWILLING_TO_PERFORM;
 		}
 	}
@@ -320,7 +317,7 @@ acl_access_allowed(
 				": root user\n",
 				op->o_connid, op->o_opid,
 				acl_access2str(access),
-				escape_string_with_punctuation(n_edn,ebuf));
+				n_edn);
 		return(LDAP_SUCCESS);
 	}
 	TNF_PROBE_0_DEBUG(acl_skipaccess_end,"ACL","");
@@ -586,7 +583,7 @@ acl_access_allowed(
 
 	slapi_log_error( SLAPI_LOG_ACL, plugin_name,
 		   "Processed attr:%s for entry:%s\n", attr ? attr : "NULL",
-		   ACL_ESCAPE_STRING_WITH_PUNCTUATION ( n_edn, ebuf));
+		    n_edn);
 
 	/*
 	** Now evaluate the rights. 
@@ -648,9 +645,8 @@ cleanup_and_ret:
 	if ( aclpb ) aclpb->aclpb_curr_attrEval = NULL;
 
 	print_access_control_summary( "main", ret_val, clientDn, aclpb, right,
-									(attr ? attr : "NULL"),
-							escape_string_with_punctuation (n_edn, ebuf),
-							&decision_reason);
+	                              (attr ? attr : "NULL"), n_edn,
+	                              &decision_reason );
 	TNF_PROBE_0_DEBUG(acl_cleanup_end,"ACL","");
 	
 	TNF_PROBE_0_DEBUG(acl_access_allowed_end,"ACL","");
@@ -877,11 +873,10 @@ acl_read_access_allowed_on_entry (
 	*/
 	if ( acl_skip_access_check ( pb, e ) ) {
 		char   *n_edn =  slapi_entry_get_ndn ( e );
-		char	ebuf [ BUFSIZ ];
 		slapi_log_error (SLAPI_LOG_ACL, plugin_name, 
 			  "Root access (%s) allowed on entry(%s)\n",
 			   acl_access2str(access), 
-			   ACL_ESCAPE_STRING_WITH_PUNCTUATION (n_edn, ebuf));
+			   n_edn);
 		TNF_PROBE_1_DEBUG(acl_read_access_allowed_on_entry_end ,"ACL","",
 							tnf_string,skip_access,"");
 		return LDAP_SUCCESS;
@@ -1156,7 +1151,6 @@ acl_read_access_allowed_on_attr (
 {
 
 	struct	acl_pblock	*aclpb =  NULL;
-	char				ebuf [ BUFSIZ ];
 	char				*clientDn = NULL;
 	char				*n_edn;
 	aclResultReason_t	decision_reason;
@@ -1176,11 +1170,10 @@ acl_read_access_allowed_on_attr (
 
 	/* If it's the root or acl is off or rootdse, he has all the priv */
 	if ( acl_skip_access_check ( pb, e ) ) {
-		char	ebuf [ BUFSIZ ];
 		slapi_log_error (SLAPI_LOG_ACL, plugin_name, 
 			  "Root access (%s) allowed on entry(%s)\n",
 			   acl_access2str(access), 
-			   ACL_ESCAPE_STRING_WITH_PUNCTUATION (n_edn, ebuf));
+			   n_edn);
 		TNF_PROBE_1_DEBUG(acl_read_access_allowed_on_attr_end ,"ACL","",
 							tnf_string,skip_aclcheck,"");
 
@@ -1219,8 +1212,7 @@ acl_read_access_allowed_on_attr (
 		if (ret_val != -1 ) {
 			slapi_log_error(SLAPI_LOG_ACL, plugin_name, 
 				 "MATCHED HANDLE:dn:%s attr: %s val:%d\n", 
-				ACL_ESCAPE_STRING_WITH_PUNCTUATION (n_edn, ebuf), attr,
-																ret_val );
+				n_edn, attr, ret_val );
 			if ( ret_val == LDAP_SUCCESS) {
 				decision_reason.reason =
 						ACL_REASON_EVALCONTEXT_CACHED_ALLOW;
@@ -1249,9 +1241,8 @@ acl_read_access_allowed_on_attr (
 	if (aclpb->aclpb_state & ACLPB_ATTR_STAR_MATCHED) {
 		slapi_log_error(SLAPI_LOG_ACL, plugin_name, 
 		 	  "STAR Access allowed on attr:%s; entry:%s \n",
-		 	   attr, ACL_ESCAPE_STRING_WITH_PUNCTUATION (n_edn, ebuf));
-		decision_reason.reason =
-						ACL_REASON_EVALCONTEXT_CACHED_ATTR_STAR_ALLOW;
+		 	   attr, n_edn);
+		decision_reason.reason = ACL_REASON_EVALCONTEXT_CACHED_ATTR_STAR_ALLOW;
 		ret_val = LDAP_SUCCESS;
 		goto acl_access_allowed_on_attr_Exit;
 
@@ -1546,7 +1537,6 @@ acl_modified (Slapi_PBlock *pb, int optype, char *n_dn, void *change)
 	int				j;
 	Slapi_Attr 		*attr = NULL;
 	Slapi_Entry		*e = NULL;
-	char			ebuf [ BUFSIZ];
 	Slapi_DN		*e_sdn;
 	aclUserGroup	*ugroup = NULL;
 	
@@ -1608,7 +1598,7 @@ acl_modified (Slapi_PBlock *pb, int optype, char *n_dn, void *change)
 		if ( group_change )  {
 			slapi_log_error(SLAPI_LOG_ACL, plugin_name,
 			"Group Change: Invalidating entire UserGroup Cache %s\n",
-			ACL_ESCAPE_STRING_WITH_PUNCTUATION(n_dn, ebuf));
+			n_dn);
 			aclg_regen_group_signature();
 			if (  (optype == SLAPI_OPERATION_MODIFY) || (optype == SLAPI_OPERATION_DELETE ) ) {
 				/* Then we need to invalidate the acl signature also */
@@ -1644,7 +1634,7 @@ acl_modified (Slapi_PBlock *pb, int optype, char *n_dn, void *change)
 		*/
 		slapi_log_error(SLAPI_LOG_ACL, plugin_name,
 			"Marking entry %s for removal from ACL user Group Cache\n",
-			ACL_ESCAPE_STRING_WITH_PUNCTUATION(n_dn, ebuf));
+			n_dn);
 		aclg_markUgroupForRemoval (ugroup);
 	}
 
@@ -1785,7 +1775,7 @@ acl_modified (Slapi_PBlock *pb, int optype, char *n_dn, void *change)
 		new_RDN = (char*) change;
 		slapi_log_error (SLAPI_LOG_ACL, plugin_name, 
 			   "acl_modified (MODRDN %s => \"%s\"\n", 
-			   ACL_ESCAPE_STRING_WITH_PUNCTUATION (n_dn, ebuf), new_RDN);
+			   n_dn, new_RDN);
 
 		/* compute new_DN: */
 		parent_DN = slapi_dn_parent (n_dn);
diff --git a/ldap/servers/plugins/acl/aclanom.c b/ldap/servers/plugins/acl/aclanom.c
index 2bb7b63..cc14eb7 100644
--- a/ldap/servers/plugins/acl/aclanom.c
+++ b/ldap/servers/plugins/acl/aclanom.c
@@ -454,7 +454,6 @@ aclanom_match_profile (Slapi_PBlock *pb, struct acl_pblock *aclpb, Slapi_Entry *
 	int						result, i, k;
 	char					**destArray;
 	int						tmatched = 0;
-	char					ebuf[ BUFSIZ ];
 	int						loglevel;
 	struct scoped_entry_anominfo *s_e_anominfo =
 			&aclpb->aclpb_scoped_entry_anominfo;
@@ -546,16 +545,16 @@ aclanom_match_profile (Slapi_PBlock *pb, struct acl_pblock *aclpb, Slapi_Entry *
 			slapi_log_error(loglevel, plugin_name, 
 				"conn=%" NSPRIu64 " op=%d: Allow access on entry(%s).attr(%s) to anonymous: acidn=\"%s\"\n",
 				op->o_connid, op->o_opid,
-				escape_string_with_punctuation(ndn, ebuf),
+				ndn,
 				attr ? attr:"NULL",
-				escape_string_with_punctuation(aci_ndn, ebuf));
+				aci_ndn);
 		} else {
 			slapi_log_error(loglevel, plugin_name,
 				"conn=%" NSPRIu64 " op=%d: Deny access on entry(%s).attr(%s) to anonymous\n",
-		op->o_connid, op->o_opid,
-                escape_string_with_punctuation(ndn, ebuf), attr ? attr:"NULL" );
+				op->o_connid, op->o_opid,
+				ndn, attr ? attr:"NULL" );
 		}
-	}	
+	}
 
 	ANOM_UNLOCK_READ ();
 	if ( tmatched == 0) 
diff --git a/ldap/servers/plugins/acl/acllas.c b/ldap/servers/plugins/acl/acllas.c
index b838bc5..a71d04f 100644
--- a/ldap/servers/plugins/acl/acllas.c
+++ b/ldap/servers/plugins/acl/acllas.c
@@ -544,7 +544,7 @@ DS_LASUserDnEval(NSErr_t *errp, char *attr_name, CmpOp_t comparator,
 			char ebuf[ BUFSIZ ];
 			slapi_log_error(SLAPI_LOG_FATAL, plugin_name,
 			 	"DS_LASUserDnEval:Syntax error(%s)\n", 
-				 escape_string_with_punctuation( user, ebuf  ));
+				 escape_string_with_punctuation( user, ebuf ));
 			return LAS_EVAL_FAIL;
 		}
 
diff --git a/ldap/servers/plugins/acl/aclutil.c b/ldap/servers/plugins/acl/aclutil.c
index 2f24da3..7097540 100644
--- a/ldap/servers/plugins/acl/aclutil.c
+++ b/ldap/servers/plugins/acl/aclutil.c
@@ -182,8 +182,7 @@ aclutil_print_aci (aci_t *aci_item, char *type)
 		   "ACI RULE type:(%s)\n",str);
 	
 	dn = slapi_sdn_get_dn ( aci_item->aci_sdn );
-	slapi_log_error (SLAPI_LOG_ACL, plugin_name,
-		"Slapi_Entry DN:%s\n", escape_string_with_punctuation (dn, str));
+	slapi_log_error (SLAPI_LOG_ACL, plugin_name, "Slapi_Entry DN:%s\n", dn);
 
 	slapi_log_error (SLAPI_LOG_ACL, plugin_name,
 		"***END ACL INFO*****************************\n");
@@ -512,7 +511,7 @@ aclutil_print_resource( struct acl_pblock *aclpb, char *right , char *attr, char
 
 	slapi_log_error (SLAPI_LOG_ACL, plugin_name, "    ************ RESOURCE INFO STARTS *********\n");
 	slapi_log_error (SLAPI_LOG_ACL, plugin_name, "    Client DN: %s\n", 
-		   clientdn ? escape_string_with_punctuation (clientdn, str) : "NULL");
+		   clientdn ? clientdn : "NULL");
 	aclutil__access_str (aclpb->aclpb_access, str);
     aclutil__typestr (aclpb->aclpb_res_type, &str[strlen(str)]);
 	slapi_log_error (SLAPI_LOG_ACL, plugin_name, "    resource type:%d(%s)\n",
@@ -520,7 +519,7 @@ aclutil_print_resource( struct acl_pblock *aclpb, char *right , char *attr, char
 
 	dn = slapi_sdn_get_dn ( aclpb->aclpb_curr_entry_sdn );
 	slapi_log_error (SLAPI_LOG_ACL, plugin_name, "    Slapi_Entry DN: %s\n", 
-		   dn ? escape_string_with_punctuation ( dn , str) : "NULL");
+		   dn ? dn  : "NULL");
 
 	slapi_log_error (SLAPI_LOG_ACL, plugin_name, "    ATTR: %s\n", attr ? attr : "NULL");
 	slapi_log_error (SLAPI_LOG_ACL, plugin_name, "    rights:%s\n", right ? right: "NULL");
diff --git a/ldap/servers/plugins/chainingdb/cb_config.c b/ldap/servers/plugins/chainingdb/cb_config.c
index 28bf556..717ea3c 100644
--- a/ldap/servers/plugins/chainingdb/cb_config.c
+++ b/ldap/servers/plugins/chainingdb/cb_config.c
@@ -63,28 +63,23 @@ int cb_config_add_dse_entries(cb_backend *cb, char **entries, char *string1, cha
         Slapi_PBlock *util_pb = NULL;
         int res, rc = 0;
         char entry_string[CB_BUFSIZE];
-        char *dn = NULL;
 
         for(x = 0; strlen(entries[x]) > 0; x++) {
                 util_pb = slapi_pblock_new();
                 PR_snprintf(entry_string, sizeof(entry_string), entries[x], string1, string2, string3);
                 e = slapi_str2entry(entry_string, 0);
-                dn = slapi_ch_strdup(slapi_entry_get_dn(e)); /* for err msg */
                 slapi_add_entry_internal_set_pb(util_pb, e, NULL, cb->identity, 0);
 		slapi_add_internal_pb(util_pb);
 		slapi_pblock_get(util_pb, SLAPI_PLUGIN_INTOP_RESULT, &res);
 		if ( LDAP_SUCCESS != res && LDAP_ALREADY_EXISTS != res ) {
-		  char ebuf[ BUFSIZ ];
 		  slapi_log_error(SLAPI_LOG_FATAL, CB_PLUGIN_SUBSYSTEM, 
 				  "Unable to add config entry (%s) to the DSE: %s\n",
-				  escape_string(dn, ebuf),
+				  slapi_entry_get_dn(e),
 				  ldap_err2string(res));
 		  rc = res;
 		  slapi_pblock_destroy(util_pb);
-		  slapi_ch_free_string(&dn);
 		  break;
 		}
-		slapi_ch_free_string(&dn);
 		slapi_pblock_destroy(util_pb);
         }
         return rc;
diff --git a/ldap/servers/plugins/cos/cos_cache.c b/ldap/servers/plugins/cos/cos_cache.c
index a93d0b5..895154d 100644
--- a/ldap/servers/plugins/cos/cos_cache.c
+++ b/ldap/servers/plugins/cos/cos_cache.c
@@ -1018,7 +1018,6 @@ static int 	cos_dn_defs_cb (Slapi_Entry* e, void *callback_data)
 	useless definition and we'll nag copiously later.
 		*/
 		char *pTmpDn = slapi_ch_strdup(pDn->val); /* because dn gets hosed on error */
-		char ebuf[ BUFSIZ ];
 		
 		if(!(rc = cos_cache_add_defn(info->pDefs, &pDn, cosType,
 								&pCosTargetTree, &pCosTemplateDn, 
@@ -1035,11 +1034,11 @@ static int 	cos_dn_defs_cb (Slapi_Entry* e, void *callback_data)
 				LDAPDebug(LDAP_DEBUG_ANY, "Skipping CoS Definition %s"
 					"--no CoS Templates found, "
 					"which should be added before the CoS Definition.\n",
-					escape_string(pTmpDn, ebuf), 0, 0);
+					pTmpDn, 0, 0);
 			} else {
 				LDAPDebug(LDAP_DEBUG_ANY, "Skipping CoS Definition %s\n"
 					"--error(%d)\n",
-					escape_string(pTmpDn, ebuf), rc, 0);
+					pTmpDn, rc, 0);
 			}
 		}
 		
diff --git a/ldap/servers/plugins/pam_passthru/pam_ptimpl.c b/ldap/servers/plugins/pam_passthru/pam_ptimpl.c
index 91dcc10..69c08e8 100644
--- a/ldap/servers/plugins/pam_passthru/pam_ptimpl.c
+++ b/ldap/servers/plugins/pam_passthru/pam_ptimpl.c
@@ -109,27 +109,26 @@ static char *
 derive_from_bind_entry(Slapi_PBlock *pb, const Slapi_DN *bindsdn, 
                        MyStrBuf *pam_id, char *map_ident_attr, int *locked)
 {
-	char buf[BUFSIZ];
 	Slapi_Entry *entry = NULL;
 	char *attrs[] = { NULL, NULL };
 	attrs[0] = map_ident_attr;
-	int rc = slapi_search_internal_get_entry(bindsdn, attrs, &entry,
+	int rc = slapi_search_internal_get_entry((Slapi_DN *)bindsdn, attrs, &entry,
 											 pam_passthruauth_get_plugin_identity());
 
 	if (rc != LDAP_SUCCESS) {
 		slapi_log_error(SLAPI_LOG_FATAL, PAM_PASSTHRU_PLUGIN_SUBSYSTEM,
 						"Could not find BIND dn %s (error %d - %s)\n",
-						escape_string(slapi_sdn_get_ndn(bindsdn), buf), rc, ldap_err2string(rc));
+						slapi_sdn_get_ndn(bindsdn), rc, ldap_err2string(rc));
 		init_my_str_buf(pam_id, NULL);
    	} else if (NULL == entry) {
 		slapi_log_error(SLAPI_LOG_FATAL, PAM_PASSTHRU_PLUGIN_SUBSYSTEM,
 						"Could not find entry for BIND dn %s\n",
-						escape_string(slapi_sdn_get_ndn(bindsdn), buf));
+						slapi_sdn_get_ndn(bindsdn));
 		init_my_str_buf(pam_id, NULL);
 	} else if (slapi_check_account_lock( pb, entry, 0, 0, 0 ) == 1) {
 		slapi_log_error(SLAPI_LOG_FATAL, PAM_PASSTHRU_PLUGIN_SUBSYSTEM,
 						"Account %s inactivated.\n",
-						escape_string(slapi_sdn_get_ndn(bindsdn), buf));
+						slapi_sdn_get_ndn(bindsdn));
 		init_my_str_buf(pam_id, NULL);
 		*locked = 1;
 	} else {
@@ -269,7 +268,6 @@ do_one_pam_auth(
 	pam_handle_t *pam_handle;
 	struct my_pam_conv_str my_data;
 	struct pam_conv my_pam_conv = {pam_conv_func, NULL};
-	char buf[BUFSIZ]; /* for error messages */
 	char *errmsg = NULL; /* free with PR_smprintf_free */
 	int locked = 0;
 
@@ -297,8 +295,7 @@ do_one_pam_auth(
 	}
 
 	if (!pam_id.str) {
-		errmsg = PR_smprintf("Bind DN [%s] is invalid or not found",
-							 escape_string(binddn, buf));
+		errmsg = PR_smprintf("Bind DN [%s] is invalid or not found", binddn);
 		retcode = LDAP_NO_SUCH_OBJECT; /* user unknown */
 		goto done; /* skip the pam stuff */
 	}
@@ -319,23 +316,23 @@ do_one_pam_auth(
 		/* check different types of errors here */
 		if (rc == PAM_USER_UNKNOWN) {
 			errmsg = PR_smprintf("User id [%s] for bind DN [%s] does not exist in PAM",
-								 pam_id.str, escape_string(binddn, buf));
+								 pam_id.str, binddn);
 			retcode = LDAP_NO_SUCH_OBJECT; /* user unknown */
 		} else if (rc == PAM_AUTH_ERR) {
 			errmsg = PR_smprintf("Invalid PAM password for user id [%s], bind DN [%s]",
-								 pam_id.str, escape_string(binddn, buf));
+								 pam_id.str, binddn);
 			retcode = LDAP_INVALID_CREDENTIALS; /* invalid creds */
 		} else if (rc == PAM_MAXTRIES) {
 			errmsg = PR_smprintf("Authentication retry limit exceeded in PAM for "
 								 "user id [%s], bind DN [%s]",
-								 pam_id.str, escape_string(binddn, buf));
+								 pam_id.str, binddn);
 			if (pw_response_requested) {
 				slapi_pwpolicy_make_response_control(pb, -1, -1, LDAP_PWPOLICY_ACCTLOCKED);
 			}
 			retcode = LDAP_CONSTRAINT_VIOLATION; /* max retries */
 		} else if (rc != PAM_SUCCESS) {
 			errmsg = PR_smprintf("Unknown PAM error [%s] for user id [%s], bind DN [%s]",
-								 pam_strerror(pam_handle, rc), pam_id.str, escape_string(binddn, buf));
+								 pam_strerror(pam_handle, rc), pam_id.str, binddn);
 			retcode = LDAP_OPERATIONS_ERROR; /* pam config or network problem */
 		}
 	}
@@ -348,16 +345,16 @@ do_one_pam_auth(
 		/* check different types of errors here */
 		if (rc == PAM_USER_UNKNOWN) {
 			errmsg = PR_smprintf("User id [%s] for bind DN [%s] does not exist in PAM",
-								 pam_id.str, escape_string(binddn, buf));
+								 pam_id.str, binddn);
 			retcode = LDAP_NO_SUCH_OBJECT; /* user unknown */
 		} else if (rc == PAM_AUTH_ERR) {
 			errmsg = PR_smprintf("Invalid PAM password for user id [%s], bind DN [%s]",
-								 pam_id.str, escape_string(binddn, buf));
+								 pam_id.str, binddn);
 			retcode = LDAP_INVALID_CREDENTIALS; /* invalid creds */
 		} else if (rc == PAM_PERM_DENIED) {
 			errmsg = PR_smprintf("Access denied for PAM user id [%s], bind DN [%s]"
 								 " - see administrator",
-								 pam_id.str, escape_string(binddn, buf));
+								 pam_id.str, binddn);
 			if (pw_response_requested) {
 				slapi_pwpolicy_make_response_control(pb, -1, -1, LDAP_PWPOLICY_ACCTLOCKED);
 			}
@@ -365,7 +362,7 @@ do_one_pam_auth(
 		} else if (rc == PAM_ACCT_EXPIRED) {
 			errmsg = PR_smprintf("Expired PAM password for user id [%s], bind DN [%s]: "
 								 "reset required",
-								 pam_id.str, escape_string(binddn, buf));
+								 pam_id.str, binddn);
 			slapi_add_pwd_control(pb, LDAP_CONTROL_PWEXPIRED, 0);
 			if (pw_response_requested) {
 				slapi_pwpolicy_make_response_control(pb, -1, -1, LDAP_PWPOLICY_PWDEXPIRED);
@@ -374,7 +371,7 @@ do_one_pam_auth(
 		} else if (rc == PAM_NEW_AUTHTOK_REQD) { /* handled same way as ACCT_EXPIRED */
 			errmsg = PR_smprintf("Expired PAM password for user id [%s], bind DN [%s]: "
 								 "reset required",
-								 pam_id.str, escape_string(binddn, buf));
+								 pam_id.str, binddn);
 			slapi_add_pwd_control(pb, LDAP_CONTROL_PWEXPIRED, 0);
 			if (pw_response_requested) {
 				slapi_pwpolicy_make_response_control(pb, -1, -1, LDAP_PWPOLICY_PWDEXPIRED);
@@ -382,7 +379,7 @@ do_one_pam_auth(
 			retcode = LDAP_INVALID_CREDENTIALS;
 		} else if (rc != PAM_SUCCESS) {
 			errmsg = PR_smprintf("Unknown PAM error [%s] for user id [%s], bind DN [%s]",
-								 pam_strerror(pam_handle, rc), pam_id.str, escape_string(binddn, buf));
+								 pam_strerror(pam_handle, rc), pam_id.str, binddn);
 			retcode = LDAP_OPERATIONS_ERROR; /* unknown */
 		}
 	}
@@ -397,7 +394,7 @@ done:
 
 	if ((retcode == LDAP_SUCCESS) && (rc != PAM_SUCCESS)) {
 		errmsg = PR_smprintf("Unknown PAM error [%d] for user id [%s], bind DN [%s]",
-							 rc, pam_id.str, escape_string(binddn, buf));
+							 rc, pam_id.str, binddn);
 		retcode = LDAP_OPERATIONS_ERROR;
 	}
 
diff --git a/ldap/servers/plugins/replication/repl5_replica.c b/ldap/servers/plugins/replication/repl5_replica.c
index db8d5be..c2e69f8 100644
--- a/ldap/servers/plugins/replication/repl5_replica.c
+++ b/ldap/servers/plugins/replication/repl5_replica.c
@@ -149,10 +149,9 @@ replica_new(const Slapi_DN *root)
 
 	    if (NULL == r)
 	    {
-			char ebuf[BUFSIZ];
 		    slapi_log_error(SLAPI_LOG_FATAL, repl_plugin_name, "Unable to "
 			    "configure replica %s: %s\n", 
-				escape_string(slapi_sdn_get_dn(root), ebuf),
+				slapi_sdn_get_dn(root),
 			    errorbuf);
 	    }
 
@@ -268,12 +267,10 @@ replica_new_from_entry (Slapi_Entry *e, char *errortext, PRBool is_add_operation
 
     if (r->legacy_consumer)
     {
-		char ebuf[BUFSIZ];
-		
         legacy_consumer_init_referrals (r);
         slapi_log_error(SLAPI_LOG_REPL, repl_plugin_name, "replica_new_from_entry: "
                         "replica for %s was configured as legacy consumer\n",
-                        escape_string(slapi_sdn_get_dn(r->repl_root),ebuf));
+                        slapi_sdn_get_dn(r->repl_root));
     }
 
 done:
@@ -419,7 +416,6 @@ replica_get_exclusive_access(Replica *r, PRBool *isInc, PRUint64 connid, int opi
 							 const char *locking_purl,
 							 char **current_purl)
 {
-	char ebuf[BUFSIZ];
 	PRBool rval = PR_TRUE;
 
 	PR_ASSERT(r);
@@ -434,7 +430,7 @@ replica_get_exclusive_access(Replica *r, PRBool *isInc, PRUint64 connid, int opi
 				"conn=%" NSPRIu64 " op=%d repl=\"%s\": "
 				"Replica in use locking_purl=%s\n",
 				connid, opid,
-				escape_string(slapi_sdn_get_dn(r->repl_root),ebuf),
+				slapi_sdn_get_dn(r->repl_root),
 				r->locking_purl ? r->locking_purl : "unknown");
 		rval = PR_FALSE;
 		if (current_purl)
@@ -447,7 +443,7 @@ replica_get_exclusive_access(Replica *r, PRBool *isInc, PRUint64 connid, int opi
         slapi_log_error(SLAPI_LOG_REPL, repl_plugin_name, 
 						"conn=%" NSPRIu64 " op=%d repl=\"%s\": Acquired replica\n",
 						connid, opid,
-						escape_string(slapi_sdn_get_dn(r->repl_root),ebuf));
+						slapi_sdn_get_dn(r->repl_root));
 		r->repl_state_flags |= REPLICA_IN_USE;
 		if (isInc && *isInc) 
 		{
@@ -475,7 +471,6 @@ replica_get_exclusive_access(Replica *r, PRBool *isInc, PRUint64 connid, int opi
 void
 replica_relinquish_exclusive_access(Replica *r, PRUint64 connid, int opid)
 {
-	char ebuf[BUFSIZ];
 	PRBool isInc;
 
 	PR_ASSERT(r);
@@ -489,13 +484,13 @@ replica_relinquish_exclusive_access(Replica *r, PRUint64 connid, int opid)
 					"conn=%" NSPRIu64 " op=%d repl=\"%s\": "
 					"Replica not in use\n",
 					connid, opid,
-					escape_string(slapi_sdn_get_dn(r->repl_root),ebuf));
+					slapi_sdn_get_dn(r->repl_root));
 	} else {
 		slapi_log_error(SLAPI_LOG_REPL, repl_plugin_name, 
 					"conn=%" NSPRIu64 " op=%d repl=\"%s\": "
 					"Released replica\n",
 					connid, opid,
-					escape_string(slapi_sdn_get_dn(r->repl_root),ebuf));
+					slapi_sdn_get_dn(r->repl_root));
 		slapi_ch_free_string(&r->locking_purl);
 		r->repl_state_flags &= ~(REPLICA_IN_USE);
 		if (isInc)
@@ -664,7 +659,6 @@ void
 replica_update_ruv(Replica *r, const CSN *updated_csn, const char *replica_purl)
 {
 	char csn_str[CSN_STRSIZE];
-	char ebuf[BUFSIZ];
 	
 	PR_ASSERT(NULL != r);
 	PR_ASSERT(NULL != updated_csn);
@@ -681,7 +675,7 @@ replica_update_ruv(Replica *r, const CSN *updated_csn, const char *replica_purl)
 	else if (NULL == updated_csn)
 	{
 		slapi_log_error(SLAPI_LOG_FATAL, repl_plugin_name, "replica_update_ruv: csn "
-			"is NULL when updating replica %s\n", escape_string(slapi_sdn_get_dn(r->repl_root),ebuf));
+			"is NULL when updating replica %s\n", slapi_sdn_get_dn(r->repl_root));
 	}
 	else
 	{
@@ -720,7 +714,7 @@ replica_update_ruv(Replica *r, const CSN *updated_csn, const char *replica_purl)
 					slapi_log_error(SLAPI_LOG_FATAL,
 						repl_plugin_name, "replica_update_ruv: unable "
 						"to update RUV for replica %s, csn = %s\n",
-						escape_string(slapi_sdn_get_dn(r->repl_root),ebuf),
+						slapi_sdn_get_dn(r->repl_root),
 						csn_as_string(updated_csn, PR_FALSE, csn_str));
 				}
 			
@@ -730,14 +724,14 @@ replica_update_ruv(Replica *r, const CSN *updated_csn, const char *replica_purl)
 			{
 				slapi_log_error(SLAPI_LOG_FATAL, repl_plugin_name,
 					"replica_update_ruv: unable to get RUV object for replica "
-					"%s\n", escape_string(slapi_sdn_get_dn(r->repl_root),ebuf));
+					"%s\n", slapi_sdn_get_dn(r->repl_root));
 			}
 		}
 		else
 		{
 			slapi_log_error(SLAPI_LOG_FATAL, repl_plugin_name, "replica_update_ruv: "
 				"unable to initialize RUV for replica %s\n",
-				escape_string(slapi_sdn_get_dn(r->repl_root),ebuf));
+				slapi_sdn_get_dn(r->repl_root));
 		}
 		PR_Unlock(r->repl_lock);
 	}
@@ -1349,8 +1343,6 @@ replica_reload_ruv (Replica *r)
             if (!ruv_covers_ruv (new_ruv, upper_bound_ruv) ||
                 !ruv_covers_ruv (upper_bound_ruv, new_ruv))
             {                
-				char ebuf[BUFSIZ];
-
                 /* create a temporary replica object to conform to the interface */
                 r_obj = object_new (r, NULL);
 
@@ -1359,7 +1351,7 @@ replica_reload_ruv (Replica *r)
 			        "Warning: new data for replica %s does not match the data in the changelog.\n"
                     " Recreating the changelog file. This could affect replication with replica's "
                     " consumers in which case the consumers should be reinitialized.\n",
-                    escape_string(slapi_sdn_get_dn(r->repl_root),ebuf));
+                    slapi_sdn_get_dn(r->repl_root));
                 rc = cl5DeleteDBSync (r_obj);
 
                 /* reinstate new ruv */
@@ -1451,7 +1443,6 @@ int replica_check_for_data_reload (Replica *r, void *arg)
 
         if (upper_bound_ruv)
         {
-            char ebuf[BUFSIZ];
             ruv_obj = replica_get_ruv (r);
             r_ruv = object_get_data (ruv_obj);
             PR_ASSERT (r_ruv);
@@ -1486,7 +1477,7 @@ int replica_check_for_data_reload (Replica *r, void *arg)
                     "Recreating the changelog file. "
                     "This could affect replication with replica's consumers in which case the "
                     "consumers should be reinitialized.\n",
-                    escape_string(slapi_sdn_get_dn(r->repl_root),ebuf));
+                    slapi_sdn_get_dn(r->repl_root));
 
                 rc = cl5DeleteDBSync (r_obj);
 
@@ -1506,7 +1497,7 @@ int replica_check_for_data_reload (Replica *r, void *arg)
                     "should remove them using CLEANRUV task.  If they are not obsolete, "
                     "you should check their status to see why there are no changes from those "
                     "servers in the changelog.\n",
-                    escape_string(slapi_sdn_get_dn(r->repl_root),ebuf));
+                    slapi_sdn_get_dn(r->repl_root));
                 rc = 0;
             }
 
@@ -1614,7 +1605,6 @@ _replica_init_from_config (Replica *r, Slapi_Entry *e, char *errortext)
     char buf [SLAPI_DSE_RETURNTEXT_SIZE];
     char *errormsg = errortext? errortext : buf;
 	Slapi_Attr *a = NULL;
-	char dnescape[BUFSIZ]; /* for escape_string */
 
 	PR_ASSERT (r && e);
 
@@ -1624,7 +1614,7 @@ _replica_init_from_config (Replica *r, Slapi_Entry *e, char *errortext)
     {
         PR_snprintf (errormsg, SLAPI_DSE_RETURNTEXT_SIZE, "failed to retrieve %s attribute from (%s)\n", 
                  attr_replicaRoot,
-				 escape_string((char*)slapi_entry_get_dn ((Slapi_Entry*)e), dnescape));
+				 (char*)slapi_entry_get_dn ((Slapi_Entry*)e));
         slapi_log_error(SLAPI_LOG_FATAL, repl_plugin_name, "_replica_init_from_config: %s\n",
                         errormsg);
                         
@@ -1691,8 +1681,7 @@ _replica_init_from_config (Replica *r, Slapi_Entry *e, char *errortext)
 						 "attribute %s must have a value greater than 0 "
 						 "and less than %d: entry %s",
 						 attr_replicaId, READ_ONLY_REPLICA_ID,
-						 escape_string((char*)slapi_entry_get_dn ((Slapi_Entry*)e),
-									   dnescape));
+						 (char*)slapi_entry_get_dn ((Slapi_Entry*)e));
 				slapi_log_error(SLAPI_LOG_FATAL, repl_plugin_name,
 								"_replica_init_from_config: %s\n",
 								errormsg);
@@ -1708,8 +1697,7 @@ _replica_init_from_config (Replica *r, Slapi_Entry *e, char *errortext)
 			PR_snprintf (errormsg, SLAPI_DSE_RETURNTEXT_SIZE,
 						 "failed to retrieve required %s attribute from %s",
 					 attr_replicaId,
-					 escape_string((char*)slapi_entry_get_dn ((Slapi_Entry*)e),
-								   dnescape));
+					 (char*)slapi_entry_get_dn ((Slapi_Entry*)e));
 			slapi_log_error(SLAPI_LOG_FATAL, repl_plugin_name,
 							"_replica_init_from_config: %s\n",
 							errormsg);
@@ -1724,8 +1712,7 @@ _replica_init_from_config (Replica *r, Slapi_Entry *e, char *errortext)
 	{
         PR_snprintf (errormsg, SLAPI_DSE_RETURNTEXT_SIZE,
 					 "failed to create csn generator for replica (%s)",
-				 escape_string((char*)slapi_entry_get_dn ((Slapi_Entry*)e),
-							   dnescape));
+					 (char*)slapi_entry_get_dn ((Slapi_Entry*)e));
         slapi_log_error(SLAPI_LOG_FATAL, repl_plugin_name,
 						"_replica_init_from_config: %s\n",
 						errormsg);
@@ -1752,7 +1739,7 @@ _replica_init_from_config (Replica *r, Slapi_Entry *e, char *errortext)
             PR_snprintf (errormsg, SLAPI_DSE_RETURNTEXT_SIZE,
 						 "failed to assign replica name for replica (%s); "
                      "uuid generator error - %d ",
-					 escape_string((char*)slapi_entry_get_dn ((Slapi_Entry*)e), dnescape),
+					 (char*)slapi_entry_get_dn ((Slapi_Entry*)e),
 					 rc);
             slapi_log_error(SLAPI_LOG_FATAL, repl_plugin_name, "_replica_init_from_config: %s\n",
                             errormsg);
@@ -1889,7 +1876,6 @@ _replica_configure_ruv  (Replica *r, PRBool isLocked)
 	RUV *ruv = NULL;
     CSN *csn = NULL;
 	ReplicaId rid = 0;
-	char ebuf[BUFSIZ];
 	
 	/* read ruv state from the ruv tombstone entry */
 	pb = slapi_pblock_new();
@@ -1924,7 +1910,7 @@ _replica_configure_ruv  (Replica *r, PRBool isLocked)
 		    slapi_log_error(SLAPI_LOG_FATAL, repl_plugin_name, 
 			    "_replica_configure_ruv: replica ruv tombstone entry for "
 			    "replica %s not found\n", 
-				escape_string(slapi_sdn_get_dn(r->repl_root),ebuf));
+				slapi_sdn_get_dn(r->repl_root));
 		    goto done;
 	    }
 	
@@ -1934,7 +1920,7 @@ _replica_configure_ruv  (Replica *r, PRBool isLocked)
             slapi_log_error(SLAPI_LOG_FATAL, repl_plugin_name, 
 			    "_replica_configure_ruv: replica ruv tombstone entry for "
 			    "replica %s does not contain %s\n", 
-				escape_string(slapi_sdn_get_dn(r->repl_root),ebuf), type_ruvElement);
+				slapi_sdn_get_dn(r->repl_root), type_ruvElement);
 		    goto done;
         }
 
@@ -2020,8 +2006,7 @@ _replica_configure_ruv  (Replica *r, PRBool isLocked)
 								"_replica_configure_ruv: "
 								"failed to recreate replica ruv tombstone entry"
 								" (%s); LDAP error - %d\n",
-								escape_string(slapi_sdn_get_dn(r->repl_root),
-								              ebuf), rc);
+								slapi_sdn_get_dn(r->repl_root), rc);
 							goto done;
 						}
 					}
@@ -2036,7 +2021,7 @@ _replica_configure_ruv  (Replica *r, PRBool isLocked)
             {
                 slapi_log_error(SLAPI_LOG_FATAL, repl_plugin_name, 
 								"RUV for replica %s is missing replica generation\n",
-								escape_string(slapi_sdn_get_dn(r->repl_root),ebuf));
+								slapi_sdn_get_dn(r->repl_root));
                 goto done;
             }		
 	    }
@@ -2044,7 +2029,7 @@ _replica_configure_ruv  (Replica *r, PRBool isLocked)
 	    {
 		    slapi_log_error(SLAPI_LOG_FATAL, repl_plugin_name,
 							"Unable to convert %s attribute in entry %s to a replica update vector.\n",
-							type_ruvElement, escape_string(slapi_sdn_get_dn(r->repl_root),ebuf));
+							type_ruvElement, slapi_sdn_get_dn(r->repl_root));
             goto done;
 	    }
 	
@@ -2071,7 +2056,7 @@ _replica_configure_ruv  (Replica *r, PRBool isLocked)
 				slapi_log_error(SLAPI_LOG_FATAL, repl_plugin_name, 
 					"_replica_configure_ruv: failed to create replica ruv tombstone "
 					"entry (%s); LDAP error - %d\n",
-					escape_string(slapi_sdn_get_dn(r->repl_root),ebuf), rc);
+					slapi_sdn_get_dn(r->repl_root), rc);
 				goto done;
 			}
             else
@@ -2079,7 +2064,7 @@ _replica_configure_ruv  (Replica *r, PRBool isLocked)
 				slapi_log_error(SLAPI_LOG_REPL, repl_plugin_name,
 					"_replica_configure_ruv: No ruv tombstone found for replica %s. "
 					"Created a new one\n",
-					escape_string(slapi_sdn_get_dn(r->repl_root),ebuf));
+					slapi_sdn_get_dn(r->repl_root));
                 return_value = 0;
             }
 		}
@@ -2092,7 +2077,7 @@ _replica_configure_ruv  (Replica *r, PRBool isLocked)
 				slapi_log_error(SLAPI_LOG_FATAL, repl_plugin_name, 
 								"_replica_configure_ruv: replication disabled for "
 								"entry (%s); LDAP error - %d\n",
-								escape_string(slapi_sdn_get_dn(r->repl_root),ebuf), rc);
+								slapi_sdn_get_dn(r->repl_root), rc);
 				slapi_ch_free_string(&state);
 				goto done;
 			}
@@ -2101,7 +2086,7 @@ _replica_configure_ruv  (Replica *r, PRBool isLocked)
 				slapi_log_error(SLAPI_LOG_FATAL, repl_plugin_name, 
 								"_replica_configure_ruv: replication broken for "
 								"entry (%s); LDAP error - %d\n",
-								escape_string(slapi_sdn_get_dn(r->repl_root),ebuf), rc);
+								slapi_sdn_get_dn(r->repl_root), rc);
 				slapi_ch_free_string(&state);
 				goto done;
 			}
@@ -2109,7 +2094,7 @@ _replica_configure_ruv  (Replica *r, PRBool isLocked)
 			{
 				slapi_log_error(SLAPI_LOG_REPL, repl_plugin_name,
 								"_replica_configure_ruv: Error %d reading tombstone for replica %s.\n",
-								rc, escape_string(slapi_sdn_get_dn(r->repl_root),ebuf));
+								rc, slapi_sdn_get_dn(r->repl_root));
                 return_value = 0;
 			}
 			slapi_ch_free_string(&state);
@@ -2269,11 +2254,9 @@ _replica_update_state (time_t when, void *arg)
 	slapi_pblock_get(pb, SLAPI_PLUGIN_INTOP_RESULT, &rc);
 	if (rc != LDAP_SUCCESS) 
 	{
-		char ebuf[BUFSIZ];
-		
 		slapi_log_error(SLAPI_LOG_FATAL, repl_plugin_name, "_replica_update_state: "
 			"failed to update state of csn generator for replica %s: LDAP "
-			"error - %d\n", escape_string(slapi_sdn_get_dn(r->repl_root),ebuf), rc);
+			"error - %d\n", slapi_sdn_get_dn(r->repl_root), rc);
 	}
 	else
 	{
@@ -2359,12 +2342,10 @@ replica_write_ruv (Replica *r)
     }
 	else /* error */
 	{
-		char ebuf[BUFSIZ];
-		
 		slapi_log_error(SLAPI_LOG_REPL, repl_plugin_name, 
 			"replica_write_ruv: failed to update RUV tombstone for %s; "
 			"LDAP error - %d\n", 
-			escape_string(slapi_sdn_get_dn(r->repl_root),ebuf), rc);
+			slapi_sdn_get_dn(r->repl_root), rc);
 	}
 
     PR_Unlock(r->repl_lock);	
@@ -2395,13 +2376,12 @@ replica_ruv_smods_for_op( Slapi_PBlock *pb, char **uniqueid, Slapi_Mods **smods
 
     slapi_pblock_get(pb, SLAPI_ENTRY_PRE_OP, &target_entry);
     if (target_entry && is_ruv_tombstone_entry(target_entry)) {
-        char ebuf[BUFSIZ];
         /* disallow direct modification of the RUV tombstone entry
            must use the CLEANRUV task instead */
         slapi_log_error(SLAPI_LOG_FATAL, repl_plugin_name, 
                         "replica_ruv_smods_for_op: attempted to directly modify the tombstone RUV "
                         "entry [%s] - use the CLEANRUV task instead\n",
-                        escape_string(slapi_entry_get_dn_const(target_entry),ebuf));
+                        slapi_entry_get_dn_const(target_entry));
         return (-1);
     }
 
@@ -2514,7 +2494,6 @@ void get_reap_result (int rc, void *cb_data)
 static int
 process_reap_entry (Slapi_Entry *entry, void *cb_data)
 {
-	char ebuf[BUFSIZ];
 	char deletion_csn_str[CSN_STRSIZE];
 	char purge_csn_str[CSN_STRSIZE];
 	unsigned long *num_entriesp = &((reap_callback_data *)cb_data)->num_entries;
@@ -2547,7 +2526,7 @@ process_reap_entry (Slapi_Entry *entry, void *cb_data)
 							"process_reap_entry: removing tombstone %s "
 							"because its deletion csn (%s) is less than the "
 							"purge csn (%s).\n", 
-							escape_string(slapi_entry_get_dn(entry), ebuf),
+							slapi_entry_get_dn(entry),
 							csn_as_string(deletion_csn, PR_FALSE, deletion_csn_str),
 							csn_as_string(purge_csn, PR_FALSE, purge_csn_str));
 		}
@@ -2561,7 +2540,7 @@ process_reap_entry (Slapi_Entry *entry, void *cb_data)
 		if (slapi_is_loglevel_set(SLAPI_LOG_REPL)) {
 			slapi_log_error(SLAPI_LOG_REPL, repl_plugin_name,
 							"process_reap_entry: NOT removing tombstone "
-							"%s\n", escape_string(slapi_entry_get_dn(entry),ebuf));
+							"%s\n", slapi_entry_get_dn(entry));
 		}
 	}
 	(*num_entriesp)++;
@@ -2583,7 +2562,6 @@ _replica_reap_tombstones(void *arg)
 	Object *replica_object = NULL;
 	Replica *replica = NULL;
 	CSN *purge_csn = NULL;
-	char ebuf[BUFSIZ];
 
 	slapi_log_error(SLAPI_LOG_REPL, repl_plugin_name,
 					"Info: Beginning tombstone reap for replica %s.\n",
@@ -2675,7 +2653,7 @@ _replica_reap_tombstones(void *arg)
 			slapi_log_error(SLAPI_LOG_FATAL, repl_plugin_name,
 							"_replica_reap_tombstones: failed when searching for "
 							"tombstones in replica %s: %s. Will try again in %ld "
-							"seconds.\n", escape_string(slapi_sdn_get_dn(replica->repl_root),ebuf),
+							"seconds.\n", slapi_sdn_get_dn(replica->repl_root),
 							ldap_err2string(oprc), replica->tombstone_reap_interval);
 		}
 		else
@@ -2684,7 +2662,7 @@ _replica_reap_tombstones(void *arg)
 							"_replica_reap_tombstones: purged %ld of %ld tombstones "
 							"in replica %s. Will try again in %ld "
 							"seconds.\n", cb_data.num_purged_entries, cb_data.num_entries,
-							escape_string(slapi_sdn_get_dn(replica->repl_root),ebuf),
+							slapi_sdn_get_dn(replica->repl_root),
 							replica->tombstone_reap_interval);
 		}
 	}
@@ -2815,7 +2793,6 @@ replica_create_ruv_tombstone(Replica *r)
     struct berval **bvals = NULL;
     Slapi_PBlock *pb = NULL;
     int rc;
-	char ebuf[BUFSIZ];
 	
 	PR_ASSERT(NULL != r && NULL != r->repl_root);
 	root_entry_str = slapi_ch_smprintf(root_glue, slapi_sdn_get_ndn(r->repl_root),
@@ -2856,7 +2833,7 @@ replica_create_ruv_tombstone(Replica *r)
 			{
 				slapi_log_error(SLAPI_LOG_FATAL, repl_plugin_name, 
 								"Cannot create new replica update vector for %s\n",
-								escape_string(slapi_sdn_get_dn(r->repl_root),ebuf));
+								slapi_sdn_get_dn(r->repl_root));
 				ruv_destroy(&ruv);
                 goto done;
 			}
@@ -2865,7 +2842,7 @@ replica_create_ruv_tombstone(Replica *r)
 		{
 			slapi_log_error(SLAPI_LOG_FATAL, repl_plugin_name,
 							"Cannot obtain CSN for new replica update vector for %s\n",
-							escape_string(slapi_sdn_get_dn(r->repl_root),ebuf));
+							slapi_sdn_get_dn(r->repl_root));
 			csn_free(&csn);
             goto done;
 		}
@@ -2944,14 +2921,13 @@ assign_csn_callback(const CSN *csn, void *data)
 	{
 		if (csnplInsert(r->min_csn_pl, csn) != 0)
 		{
-			char ebuf[BUFSIZ];
 			char csn_str[CSN_STRSIZE]; /* For logging only */
 			/* Ack, we can't keep track of min csn. Punt. */
 			if (slapi_is_loglevel_set(SLAPI_LOG_REPL)) {
 				slapi_log_error(SLAPI_LOG_REPL, repl_plugin_name, "assign_csn_callback: "
 								"failed to insert csn %s for replica %s\n",
 								csn_as_string(csn, PR_FALSE, csn_str),
-								escape_string(slapi_sdn_get_dn(r->repl_root), ebuf));
+								slapi_sdn_get_dn(r->repl_root));
 			}
 			csnplFree(&r->min_csn_pl);
 		}
@@ -3100,12 +3076,10 @@ replica_remove_legacy_attr (const Slapi_DN *repl_root_sdn, const char *attr)
 	slapi_pblock_get(pb, SLAPI_PLUGIN_INTOP_RESULT, &rc);
     if (rc != LDAP_SUCCESS) 
 	{
-		char ebuf[BUFSIZ];
-		
         /* this is not a fatal error because the attribute may not be there */
 		slapi_log_error(SLAPI_LOG_REPL, repl_plugin_name, "replica_remove_legacy_attr: "
 			"failed to remove legacy attribute %s for replica %s; LDAP error - %d\n", 
-            attr, escape_string(slapi_sdn_get_dn(repl_root_sdn),ebuf), rc);
+            attr, slapi_sdn_get_dn(repl_root_sdn), rc);
 	}
     
     slapi_mods_done (&smods);
diff --git a/ldap/servers/plugins/replication/repl5_replica_config.c b/ldap/servers/plugins/replication/repl5_replica_config.c
index e0e11e9..94f4179 100644
--- a/ldap/servers/plugins/replication/repl5_replica_config.c
+++ b/ldap/servers/plugins/replication/repl5_replica_config.c
@@ -622,8 +622,6 @@ replica_config_delete (Slapi_PBlock *pb, Slapi_Entry* e, Slapi_Entry* entryAfter
 
     if (mtnode_ext->replica)
     {
-        char ebuf[BUFSIZ];
-
         /* remove object from the hash */
         r = (Replica*)object_get_data (mtnode_ext->replica);
         PR_ASSERT (r);
@@ -631,7 +629,7 @@ replica_config_delete (Slapi_PBlock *pb, Slapi_Entry* e, Slapi_Entry* entryAfter
         slapi_log_error(SLAPI_LOG_FATAL, repl_plugin_name, "replica_config_delete: "
                         "Warning: The changelog for replica %s is no longer valid since "
                         "the replica config is being deleted.  Removing the changelog.\n",
-                        escape_string(slapi_sdn_get_dn(replica_get_root(r)),ebuf));
+                        slapi_sdn_get_dn(replica_get_root(r)));
         cl5DeleteDBSync(mtnode_ext->replica);
         replica_delete_by_name (replica_get_name (r));
         object_release (mtnode_ext->replica);
@@ -1068,7 +1066,6 @@ _replica_config_get_mtnode_ext (const Slapi_Entry *e)
     Slapi_DN *sdn = NULL;
     mapping_tree_node *mtnode;
     multimaster_mtnode_extension *ext = NULL;
-    char ebuf[BUFSIZ];
 
     /* retirve root of the tree for which replica is configured */
     replica_root = slapi_entry_attr_get_charptr (e, attr_replicaRoot);
@@ -1076,7 +1073,7 @@ _replica_config_get_mtnode_ext (const Slapi_Entry *e)
     {
         slapi_log_error(SLAPI_LOG_FATAL, repl_plugin_name, "replica_config_add: "
                         "configuration entry %s missing %s attribute\n",
-                        escape_string(slapi_entry_get_dn((Slapi_Entry *)e), ebuf),
+                        slapi_entry_get_dn((Slapi_Entry *)e),
                         attr_replicaRoot);   
         return NULL;
     }
@@ -1089,7 +1086,7 @@ _replica_config_get_mtnode_ext (const Slapi_Entry *e)
     {
         slapi_log_error(SLAPI_LOG_FATAL, repl_plugin_name, "replica_config_add: "
                         "failed to locate mapping tree node for dn %s\n",
-                        escape_string(slapi_sdn_get_dn(sdn), ebuf));        
+                        slapi_sdn_get_dn(sdn));        
     }
     else
     {
diff --git a/ldap/servers/plugins/replication/replutil.c b/ldap/servers/plugins/replication/replutil.c
index 3eec20a..b09bf53 100644
--- a/ldap/servers/plugins/replication/replutil.c
+++ b/ldap/servers/plugins/replication/replutil.c
@@ -789,10 +789,9 @@ repl_set_mtn_state_and_referrals(
         }
 
         if (rc != LDAP_SUCCESS) {
-		char ebuf[BUFSIZ];
 		slapi_log_error(SLAPI_LOG_FATAL, repl_plugin_name, "repl_set_mtn_referrals: could "
 						"not set referrals for replica %s: %d\n",
-						escape_string(slapi_sdn_get_dn(repl_root_sdn), ebuf), rc);
+						slapi_sdn_get_dn(repl_root_sdn), rc);
 	}
 
 	charray_free(referrals_to_set);
diff --git a/ldap/servers/plugins/replication/urp.c b/ldap/servers/plugins/replication/urp.c
index a0168fb..bc32473 100644
--- a/ldap/servers/plugins/replication/urp.c
+++ b/ldap/servers/plugins/replication/urp.c
@@ -971,7 +971,6 @@ urp_annotate_dn (char *sessionid, Slapi_Entry *entry, CSN *opcsn, const char *op
 	const char *uniqueid;
 	const Slapi_DN *basesdn;
 	const char *basedn;
-	char ebuf[BUFSIZ];
 
 	uniqueid = slapi_entry_get_uniqueid (entry);
 	basesdn = slapi_entry_get_sdn_const (entry);
@@ -986,7 +985,7 @@ urp_annotate_dn (char *sessionid, Slapi_Entry *entry, CSN *opcsn, const char *op
 		case LDAP_SUCCESS:
 			slapi_log_error(slapi_log_urp, sessionid,
 				"Naming conflict %s. Renamed existing entry to %s\n",
-				optype, escape_string (newrdn, ebuf));
+				optype, newrdn);
 			rc = 1;
 			break;
 		case LDAP_NO_SUCH_OBJECT:
@@ -1008,7 +1007,7 @@ urp_annotate_dn (char *sessionid, Slapi_Entry *entry, CSN *opcsn, const char *op
 			 */
 			slapi_log_error( SLAPI_LOG_FATAL, sessionid,
 				"Entry %s exists in cache but not in DB\n",
-				escape_string (basedn, ebuf) );
+				basedn );
 			rc = LDAP_NO_SUCH_OBJECT;
 			break;
 		default:
diff --git a/ldap/servers/plugins/replication/urp_glue.c b/ldap/servers/plugins/replication/urp_glue.c
index e51712c..369363d 100644
--- a/ldap/servers/plugins/replication/urp_glue.c
+++ b/ldap/servers/plugins/replication/urp_glue.c
@@ -97,7 +97,6 @@ entry_to_glue(char *sessionid, const Slapi_Entry* entry, const char *reason, CSN
 	int op_result = 0;
 	const char *dn;
 	const Slapi_DN *sdn;
-	char ebuf[BUFSIZ];
     slapi_mods smods;
 	Slapi_Attr *attr;
 
@@ -121,7 +120,7 @@ entry_to_glue(char *sessionid, const Slapi_Entry* entry, const char *reason, CSN
 	{
 		slapi_log_error(SLAPI_LOG_REPL, repl_plugin_name, 
 				"%s: Target entry %s is already a glue entry reason %s\n",
-				sessionid, escape_string(dn, ebuf), reason);
+				sessionid, dn, reason);
 	}
 
 	if (slapi_entry_attr_find (entry, ATTR_NSDS5_REPLCONFLICT, &attr) == 0)
@@ -140,7 +139,7 @@ entry_to_glue(char *sessionid, const Slapi_Entry* entry, const char *reason, CSN
 		{
 			slapi_log_error (slapi_log_urp, repl_plugin_name,
 				"%s: Turned the entry %s to glue, reason %s\n",
-				sessionid, escape_string(dn, ebuf), reason);
+				sessionid, dn, reason);
 		}
     }
 
diff --git a/ldap/servers/plugins/replication/windows_connection.c b/ldap/servers/plugins/replication/windows_connection.c
index f2bda92..0393627 100644
--- a/ldap/servers/plugins/replication/windows_connection.c
+++ b/ldap/servers/plugins/replication/windows_connection.c
@@ -461,14 +461,13 @@ windows_perform_operation(Repl_Connection *conn, int optype, const char *dn,
 				 * enough information to allow them to fix the problem
 				 * and retry - bug 170350 */
 				if (conn->last_ldap_error == LDAP_CONSTRAINT_VIOLATION) {
-					char ebuf[BUFSIZ];
 					slapi_log_error(SLAPI_LOG_FATAL, repl_plugin_name,
 						"%s: Received error [%s] when attempting to %s"
 						" entry [%s]: Please correct the attribute specified "
 						"in the error message.  Refer to the Windows Active "
 						"Directory docs for more information.\n",
 						agmt_get_long_name(conn->agmt),
-						errmsg, op_string, escape_string(dn, ebuf));
+						errmsg, op_string, dn);
 				} else {
 					slapi_log_error(SLAPI_LOG_REPL, repl_plugin_name,
 						"%s: Received result code %d (%s) for %s operation %s%s\n",
diff --git a/ldap/servers/plugins/replication/windows_protocol_util.c b/ldap/servers/plugins/replication/windows_protocol_util.c
index d42cd96..a2ec448 100644
--- a/ldap/servers/plugins/replication/windows_protocol_util.c
+++ b/ldap/servers/plugins/replication/windows_protocol_util.c
@@ -4510,10 +4510,9 @@ windows_update_remote_entry(Private_Repl_Protocol *prp,Slapi_Entry *remote_entry
 	/* Now perform the modify if we need to */
 	if (0 == retval && do_modify)
 	{
-		char dnbuf[BUFSIZ];
 		const char *dn = slapi_sdn_get_dn(slapi_entry_get_sdn_const(remote_entry));
 		slapi_log_error(SLAPI_LOG_REPL, windows_repl_plugin_name,
-			"windows_update_remote_entry: modifying entry %s\n", escape_string(dn, dnbuf));
+			"windows_update_remote_entry: modifying entry %s\n", dn);
 
 		retval = windows_conn_send_modify(prp->conn, slapi_sdn_get_dn(slapi_entry_get_sdn_const(remote_entry)),slapi_mods_get_ldapmods_byref(&smods), NULL,NULL);
 
@@ -4545,10 +4544,9 @@ windows_update_remote_entry(Private_Repl_Protocol *prp,Slapi_Entry *remote_entry
 		}
 	} else
 	{
-		char dnbuf[BUFSIZ];
 		const char *dn = slapi_sdn_get_dn(slapi_entry_get_sdn_const(remote_entry));
 		slapi_log_error(SLAPI_LOG_REPL, windows_repl_plugin_name,
-			"no mods generated for remote entry: %s\n", escape_string(dn, dnbuf));
+			"no mods generated for remote entry: %s\n", dn);
 	}
 
 	slapi_mods_done(&smods);
@@ -4660,10 +4658,9 @@ windows_update_local_entry(Private_Repl_Protocol *prp,Slapi_Entry *remote_entry,
 		pb = slapi_pblock_new();
 		if (pb)
 		{
-			char dnbuf[BUFSIZ];
 			const char *dn = slapi_entry_get_dn_const(local_entry);
 			slapi_log_error(SLAPI_LOG_REPL, windows_repl_plugin_name,
-				"modifying entry: %s\n", escape_string(dn, dnbuf));
+				"modifying entry: %s\n", dn);
 			slapi_modify_internal_set_pb_ext (pb,
 			    slapi_entry_get_sdn(local_entry),
 			    slapi_mods_get_ldapmods_byref(&smods), NULL, NULL,
@@ -4687,7 +4684,7 @@ windows_update_local_entry(Private_Repl_Protocol *prp,Slapi_Entry *remote_entry,
 			{
 				slapi_log_error(SLAPI_LOG_FATAL, windows_repl_plugin_name,
 					"windows_update_local_entry: failed to modify entry %s - error %d:%s\n",
-					escape_string(dn, dnbuf), rc, ldap_err2string(rc));
+					dn, rc, ldap_err2string(rc));
 			}
 			slapi_pblock_destroy(pb);
 		} else 
@@ -4698,10 +4695,9 @@ windows_update_local_entry(Private_Repl_Protocol *prp,Slapi_Entry *remote_entry,
 
 	} else
 	{
-		char dnbuf[BUFSIZ];
 		const char *dn = slapi_entry_get_dn_const(local_entry);
 		slapi_log_error(SLAPI_LOG_REPL, windows_repl_plugin_name,
-			"no mods generated for local entry: %s\n", escape_string(dn, dnbuf));
+			"no mods generated for local entry: %s\n", dn);
 	}
 
 bail:
diff --git a/ldap/servers/plugins/views/views.c b/ldap/servers/plugins/views/views.c
index 48b6803..0892b0d 100644
--- a/ldap/servers/plugins/views/views.c
+++ b/ldap/servers/plugins/views/views.c
@@ -787,10 +787,9 @@ static void views_cache_create_applied_filter(viewEntry *pView)
 
 		pCurrentFilter = slapi_str2filter( buf );
 		if (!pCurrentFilter) {
-			char ebuf[BUFSIZ];
 			slapi_log_error(SLAPI_LOG_FATAL, VIEWS_PLUGIN_SUBSYSTEM,
 							"Error: the view filter [%s] in entry [%s] is not valid\n",
-							buf, escape_string(current->pDn, ebuf));
+							buf, current->pDn);
 		}
 		if(pBuiltFilter && pCurrentFilter)
 			pBuiltFilter = slapi_filter_join_ex( LDAP_FILTER_AND, pBuiltFilter, pCurrentFilter, 0 );
@@ -964,10 +963,9 @@ Slapi_Filter *views_cache_create_descendent_filter(viewEntry *ancestor, PRBool u
 		{
 			pCurrentFilter = slapi_str2filter( buf );
 			if (!pCurrentFilter) {
-				char ebuf[BUFSIZ];
 				slapi_log_error(SLAPI_LOG_FATAL, VIEWS_PLUGIN_SUBSYSTEM,
 								"Error: the view filter [%s] in entry [%s] is not valid\n",
-								buf, escape_string(currentChild->pDn, ebuf));
+								buf, currentChild->pDn);
 			}
 			if(pOrSubFilter && pCurrentFilter)
 				pOrSubFilter = slapi_filter_join_ex( LDAP_FILTER_OR, pOrSubFilter, pCurrentFilter, 0 );
@@ -1029,10 +1027,9 @@ static void views_cache_create_inclusion_filter(viewEntry *pView)
 		sprintf(buf, "(%s)", viewRDNstr );
 		viewSubFilter = slapi_str2filter( buf );
 		if (!viewSubFilter) {
-			char ebuf[BUFSIZ];
 			slapi_log_error(SLAPI_LOG_FATAL, VIEWS_PLUGIN_SUBSYSTEM,
 							"Error: the view filter [%s] in entry [%s] is not valid\n",
-							buf, escape_string(current->pDn, ebuf));
+							buf, current->pDn);
 		}
 
 		if(pView->includeChildViewsFilter && viewSubFilter)
diff --git a/ldap/servers/slapd/add.c b/ldap/servers/slapd/add.c
index 204e13c..9966a27 100644
--- a/ldap/servers/slapd/add.c
+++ b/ldap/servers/slapd/add.c
@@ -91,7 +91,6 @@ do_add( Slapi_PBlock *pb )
 	Slapi_Entry		*e = NULL;
 	int			err;
 	int			rc;
-	char			ebuf[ BUFSIZ ];
 	PRBool  searchsubentry=PR_TRUE;
 
 	LDAPDebug( LDAP_DEBUG_TRACE, "do_add\n", 0, 0, 0 );
@@ -183,6 +182,7 @@ do_add( Slapi_PBlock *pb )
 
 		normtype = slapi_attr_syntax_normalize(type);
 		if ( !normtype || !*normtype ) {
+			char ebuf[ BUFSIZ ];
 			rc = LDAP_INVALID_SYNTAX;
 			PR_snprintf (ebuf, BUFSIZ, "invalid type '%s'", type);
 			op_shared_log_error_access (pb, "ADD", slapi_sdn_get_dn (slapi_entry_get_sdn_const(e)), ebuf);
@@ -202,7 +202,7 @@ do_add( Slapi_PBlock *pb )
 				slapi_log_access( LDAP_DEBUG_STATS, 
 					"conn=%" NSPRIu64 " op=%d ADD dn=\"%s\", add values for type %s failed\n",
 					pb->pb_conn->c_connid, operation->o_opid, 
-					escape_string( slapi_entry_get_dn_const(e), ebuf ), normtype );
+					slapi_entry_get_dn_const(e), normtype );
 				send_ldap_result( pb, rc, NULL, NULL, 0, NULL );
 
 				slapi_ch_free( (void**)&normtype );
@@ -445,7 +445,6 @@ static void op_shared_add (Slapi_PBlock *pb)
 	Slapi_Entry	*e, *pse;
 	Slapi_Backend *be = NULL;
 	int	err;
-	char ebuf[BUFSIZ];
 	int internal_op, repl_op, legacy_op, lastmod;
 	char *pwdtype = NULL;
 	Slapi_Value **unhashed_password_vals = NULL;
@@ -489,7 +488,7 @@ static void op_shared_add (Slapi_PBlock *pb)
 			slapi_log_access(LDAP_DEBUG_STATS, "conn=%" NSPRIu64 " op=%d ADD dn=\"%s\"%s\n",
 							 pb->pb_conn->c_connid, 
 							 operation->o_opid,
-							 escape_string(slapi_entry_get_dn_const(e), ebuf),
+							 slapi_entry_get_dn_const(e),
 							 proxystr ? proxystr : "");
 		}
 		else
@@ -497,7 +496,7 @@ static void op_shared_add (Slapi_PBlock *pb)
 			slapi_log_access(LDAP_DEBUG_ARGS, "conn=%s op=%d ADD dn=\"%s\"\n",
 							 LOG_INTERNAL_OP_CON_ID,
 							 LOG_INTERNAL_OP_OP_ID,
-							 escape_string(slapi_entry_get_dn_const(e), ebuf));
+							 slapi_entry_get_dn_const(e));
 		}
 	}
 
diff --git a/ldap/servers/slapd/attr.c b/ldap/servers/slapd/attr.c
index 26d5947..95a7808 100644
--- a/ldap/servers/slapd/attr.c
+++ b/ldap/servers/slapd/attr.c
@@ -822,7 +822,6 @@ attr_add_valuearray(Slapi_Attr *a, Slapi_Value **vals, const char *dn)
      * LDAP_OPERATIONS_ERROR
      */
     else if ( duplicate_index >= 0 ) {
-        char avdbuf[BUFSIZ];
         char bvvalcopy[BUFSIZ];
         char *duplicate_string = "null or non-ASCII";
 
@@ -849,7 +848,7 @@ attr_add_valuearray(Slapi_Attr *a, Slapi_Value **vals, const char *dn)
                 "attribute type \"%s\" in entry \"%s\" failed: %s\n", 
                 duplicate_string,
                 a->a_type,
-                dn ? escape_string(dn,avdbuf) : "<null>", 
+                dn ? dn : "<null>", 
                 (was_present_null ? "duplicate new value" : "value exists"));
     }
     return( rc );
diff --git a/ldap/servers/slapd/auth.c b/ldap/servers/slapd/auth.c
index 0631b15..4976406 100644
--- a/ldap/servers/slapd/auth.c
+++ b/ldap/servers/slapd/auth.c
@@ -103,27 +103,28 @@ slapu_search_s( LDAP* ld, const char* rawbaseDN, int scope, const char* filter,
     ctrls[0]->ldctl_value.bv_val = NULL;
     ctrls[0]->ldctl_value.bv_len = 0;
     ctrls[0]->ldctl_iscritical = '\0';
-    slapi_search_internal_set_pb(pb, baseDN, scope, (char *)filter, attrs, attrsonly, 
-	ctrls, NULL, auth_get_component_id(), 0 /* actions */);
+    slapi_search_internal_set_pb(pb, baseDN, scope, (char *)filter, attrs,
+                                 attrsonly, ctrls, NULL,
+                                 auth_get_component_id(), 0 /* actions */);
     slapi_search_internal_pb(pb);
 
     if (pb != NULL) {
-	if (slapi_pblock_get (pb, SLAPI_PLUGIN_INTOP_RESULT, &err)) {
-	    err = LDAP_LOCAL_ERROR;
-	}
-	if (err != LDAP_SUCCESS) {
-	    slapu_msgfree (ld, (LDAPMessage*)pb);
-	    pb = NULL;
-	    if (scope == LDAP_SCOPE_SUBTREE) {
-		char ebuf[ BUFSIZ ], fbuf[ BUFSIZ ];
-		LDAPDebug (LDAP_DEBUG_ANY, "slapi_search_internal (\"%s\", subtree, %s) err %i\n",
-			   escape_string( (char*)baseDN, ebuf ), escape_string( (char*)filter, fbuf ), err);
-	    }
-	}
+        if (slapi_pblock_get (pb, SLAPI_PLUGIN_INTOP_RESULT, &err)) {
+            err = LDAP_LOCAL_ERROR;
+        }
+        if (err != LDAP_SUCCESS) {
+            slapu_msgfree (ld, (LDAPMessage*)pb);
+            pb = NULL;
+            if (scope == LDAP_SCOPE_SUBTREE) {
+                char fbuf[ BUFSIZ ];
+                LDAPDebug (LDAP_DEBUG_ANY, "slapi_search_internal (\"%s\", subtree, %s) err %i\n",
+                           baseDN, escape_string( (char*)filter, fbuf ), err);
+            }
+        }
     } else {
-	char ebuf[ BUFSIZ ], fbuf[ BUFSIZ ];
-	LDAPDebug (LDAP_DEBUG_ANY, "slapi_search_internal (\"%s\", %i, %s) NULL\n",
-		   escape_string( (char*)baseDN, ebuf ), scope, escape_string( (char*)filter, fbuf ));
+        char fbuf[ BUFSIZ ];
+        LDAPDebug (LDAP_DEBUG_ANY, "slapi_search_internal (\"%s\", %i, %s) NULL\n",
+                   baseDN, scope, escape_string( (char*)filter, fbuf ));
     }
     slapi_sdn_free(&sdn);
     *result = (LDAPMessage*)pb;
@@ -520,14 +521,13 @@ handle_handshake_done (PRFileDesc *prfd, void* clientData)
     }
 
     if (clientDN != NULL) {
-        char ebuf[ BUFSIZ ];
         Slapi_DN *sdn = NULL;
         sdn = slapi_sdn_new_dn_passin(clientDN);
         clientDN = slapi_ch_strdup(slapi_sdn_get_dn(sdn));
         slapi_sdn_free(&sdn);
         slapi_log_access (LDAP_DEBUG_STATS, 
                           "conn=%" NSPRIu64 " SSL client bound as %s\n",
-                          conn->c_connid, escape_string( clientDN, ebuf ));
+                          conn->c_connid, clientDN);
     } else if (clientCert != NULL) {
         slapi_log_access (LDAP_DEBUG_STATS,
                           "conn=%" NSPRIu64 " SSL failed to map client "
diff --git a/ldap/servers/slapd/back-ldbm/import-threads.c b/ldap/servers/slapd/back-ldbm/import-threads.c
index f60c749..60dbb5f 100644
--- a/ldap/servers/slapd/back-ldbm/import-threads.c
+++ b/ldap/servers/slapd/back-ldbm/import-threads.c
@@ -100,11 +100,10 @@ static int import_generate_uniqueid(ImportJob *job, Slapi_Entry *e)
         if (rc == UID_SUCCESS) {
             slapi_entry_set_uniqueid (e, newuniqueid);
         } else {
-            char ebuf[BUFSIZ];
             LDAPDebug( LDAP_DEBUG_ANY,
                        "import_generate_uniqueid: failed to generate "
                        "uniqueid for %s; error=%d.\n", 
-                       escape_string(slapi_entry_get_dn_const(e), ebuf), rc, 0 );
+                       slapi_entry_get_dn_const(e), rc, 0 );
         }                
     }
 
@@ -572,10 +571,9 @@ import_producer(void *param)
         }
 
         if (slapi_entry_schema_check(NULL, e) != 0) {
-            char ebuf[BUFSIZ];
             import_log_notice(job, "WARNING: skipping entry \"%s\" which "
                               "violates schema, ending line %d of file "
-                              "\"%s\"", escape_string(slapi_entry_get_dn(e), ebuf),
+                              "\"%s\"", slapi_entry_get_dn(e),
                               curr_lineno, curr_filename);
             slapi_entry_free(e);
 
@@ -626,10 +624,9 @@ import_producer(void *param)
         /* Check attribute syntax */
         if (syntax_err != 0)
         {
-            char ebuf[BUFSIZ];
             import_log_notice(job, "WARNING: skipping entry \"%s\" which "
                               "violates attribute syntax, ending line %d of "
-                              "file \"%s\"", escape_string(slapi_entry_get_dn(e), ebuf),
+                              "file \"%s\"", slapi_entry_get_dn(e),
                               curr_lineno, curr_filename);
             slapi_entry_free(e);
 
@@ -721,10 +718,9 @@ import_producer(void *param)
 
         newesize = (slapi_entry_size(ep->ep_entry) + sizeof(struct backentry));
         if (newesize > job->fifo.bsize) {    /* entry too big */
-            char ebuf[BUFSIZ];
             import_log_notice(job, "WARNING: skipping entry \"%s\" "
                     "ending line %d of file \"%s\"",
-                    escape_string(slapi_entry_get_dn(e), ebuf),
+                    slapi_entry_get_dn(e),
                     curr_lineno, curr_filename);
             import_log_notice(job, "REASON: entry too large (%lu bytes) for "
                     "the buffer size (%lu bytes)", newesize, job->fifo.bsize);
@@ -854,9 +850,8 @@ index_set_entry_to_fifo(ImportWorkerInfo *info, Slapi_Entry *e,
 
     newesize = (slapi_entry_size(ep->ep_entry) + sizeof(struct backentry));
     if (newesize > job->fifo.bsize) {    /* entry too big */
-        char ebuf[BUFSIZ];
         import_log_notice(job, "WARNING: skipping entry \"%s\"",
-                    escape_string(slapi_entry_get_dn(e), ebuf));
+                    slapi_entry_get_dn(e));
         import_log_notice(job, "REASON: entry too large (%lu bytes) for "
                     "the buffer size (%lu bytes)", newesize, job->fifo.bsize);
         backentry_free(&ep);
@@ -1779,9 +1774,8 @@ upgradedn_producer(void *param)
 
         newesize = (slapi_entry_size(ep->ep_entry) + sizeof(struct backentry));
         if (newesize > job->fifo.bsize) {    /* entry too big */
-            char ebuf[BUFSIZ];
             import_log_notice(job, "WARNING: skipping entry \"%s\"",
-                    escape_string(slapi_entry_get_dn(e), ebuf));
+                    slapi_entry_get_dn(e));
             import_log_notice(job, "REASON: entry too large (%lu bytes) for "
                     "the buffer size (%lu bytes)", newesize, job->fifo.bsize);
             backentry_free(&ep);
@@ -2970,9 +2964,8 @@ static int bulk_import_queue(ImportJob *job, Slapi_Entry *entry)
 
     newesize = (slapi_entry_size(ep->ep_entry) + sizeof(struct backentry));
     if (newesize > job->fifo.bsize) {    /* entry too big */
-        char ebuf[BUFSIZ];
         import_log_notice(job, "WARNING: skipping entry \"%s\"",
-                    escape_string(slapi_entry_get_dn(ep->ep_entry), ebuf));
+                    slapi_entry_get_dn(ep->ep_entry));
         import_log_notice(job, "REASON: entry too large (%lu bytes) for "
                     "the import buffer size (%lu bytes).   Try increasing nsslapd-cachememsize.", newesize, job->fifo.bsize);
         backentry_clear_entry(ep);      /* entry is released in the frontend on failure*/
diff --git a/ldap/servers/slapd/back-ldbm/ldbm_modrdn.c b/ldap/servers/slapd/back-ldbm/ldbm_modrdn.c
index 300dca1..b3d8111 100644
--- a/ldap/servers/slapd/back-ldbm/ldbm_modrdn.c
+++ b/ldap/servers/slapd/back-ldbm/ldbm_modrdn.c
@@ -115,7 +115,6 @@ ldbm_back_modrdn( Slapi_PBlock *pb )
     entry_address *old_addr;
     entry_address oldparent_addr;
     entry_address *newsuperior_addr;
-    char ebuf[BUFSIZ];
     char *original_newrdn = NULL;
     CSN *opcsn = NULL;
     const char *newdn = NULL;
@@ -593,7 +592,7 @@ ldbm_back_modrdn( Slapi_PBlock *pb )
     {
         ldap_result_code= LDAP_OPERATIONS_ERROR;
         LDAPDebug( LDAP_DEBUG_TRACE, "ldbm_modrdn: entry_apply_mods failed for entry %s\n",
-                   escape_string(slapi_entry_get_dn_const(ec->ep_entry), ebuf), 0, 0);
+                   slapi_entry_get_dn_const(ec->ep_entry), 0, 0);
         goto error_return;
     }
 
@@ -606,7 +605,7 @@ ldbm_back_modrdn( Slapi_PBlock *pb )
         {
             ldap_result_code= LDAP_OPERATIONS_ERROR;
             LDAPDebug( LDAP_DEBUG_TRACE, "ldbm_modrdn: entry_apply_mods_wsi failed for entry %s\n",
-                       escape_string(slapi_entry_get_dn_const(ec->ep_entry), ebuf), 0, 0);
+                       slapi_entry_get_dn_const(ec->ep_entry), 0, 0);
             goto error_return;
         }
     }
@@ -624,7 +623,7 @@ ldbm_back_modrdn( Slapi_PBlock *pb )
         {
             ldap_result_code= LDAP_OPERATIONS_ERROR;
             LDAPDebug( LDAP_DEBUG_TRACE, "ldbm_modrdn: entry_apply_mods_wsi (operational attributes) failed for entry %s\n",
-                       escape_string(slapi_entry_get_dn_const(ec->ep_entry), ebuf), 0, 0);
+                       slapi_entry_get_dn_const(ec->ep_entry), 0, 0);
             goto error_return;
         }
     }
@@ -884,9 +883,8 @@ ldbm_back_modrdn( Slapi_PBlock *pb )
                     memset(&sv,0,sizeof(Slapi_Value));
                     if ( slapi_rdn2typeval( rdns[i], &type, &sv.bv ) != 0 ) 
                     {
-                        char ebuf[ BUFSIZ ];
                         LDAPDebug( LDAP_DEBUG_ANY, "modrdn: rdn2typeval (%s) failed\n",
-                                   escape_string( rdns[i], ebuf ), 0, 0 );
+                                    rdns[i], 0, 0 );
                         if (LDBM_OS_ERR_IS_DISKFULL(retval)) disk_full = 1;
                         MOD_SET_ERROR(ldap_result_code, 
                                       LDAP_OPERATIONS_ERROR, retry_count);
@@ -1443,7 +1441,6 @@ moddn_rdn_add_needed (
 static int
 moddn_newrdn_mods(Slapi_PBlock *pb, const char *olddn, struct backentry *ec, Slapi_Mods *smods_wsi, int is_repl_op)
 {
-    char ebuf[BUFSIZ];
     char **rdns = NULL;
     char **dns = NULL;
     int deleteoldrdn;
@@ -1514,7 +1511,7 @@ moddn_newrdn_mods(Slapi_PBlock *pb, const char *olddn, struct backentry *ec, Sla
     if ( baddn || badrdn )
     {
         LDAPDebug( LDAP_DEBUG_TRACE, "moddn_newrdn_mods failed: olddn=%s baddn=%d badrdn=%d\n",
-                   escape_string(olddn, ebuf), baddn, badrdn);
+                   olddn, baddn, badrdn);
         return LDAP_OPERATIONS_ERROR;
     }
     }
@@ -1544,7 +1541,7 @@ moddn_newrdn_mods(Slapi_PBlock *pb, const char *olddn, struct backentry *ec, Sla
     else
     {
     LDAPDebug( LDAP_DEBUG_TRACE, "moddn_newrdn_mods failed: could not parse new rdn %s\n",
-           escape_string(newrdn, ebuf), 0, 0);
+           newrdn, 0, 0);
         return LDAP_OPERATIONS_ERROR;
     }
     
diff --git a/ldap/servers/slapd/back-ldbm/ldbm_search.c b/ldap/servers/slapd/back-ldbm/ldbm_search.c
index e6967e8..4f756fa 100644
--- a/ldap/servers/slapd/back-ldbm/ldbm_search.c
+++ b/ldap/servers/slapd/back-ldbm/ldbm_search.c
@@ -206,12 +206,11 @@ ldbm_search_compile_filter(Slapi_Filter *f, void *arg)
     int rc = SLAPI_FILTER_SCAN_CONTINUE;
     if (f->f_choice == LDAP_FILTER_SUBSTRINGS) {
         char pat[BUFSIZ];
-        char *p, *end, *tmpbuf, *bigpat = NULL;
+        char *p, *end, *bigpat = NULL;
         size_t size = 0;
         Slapi_Regex *re = NULL;
         const char *re_result = NULL;
         int i = 0;
-        char ebuf[BUFSIZ];
 
         PR_ASSERT(NULL == f->f_un.f_un_sub.sf_private);
         /*
@@ -260,13 +259,13 @@ ldbm_search_compile_filter(Slapi_Filter *f, void *arg)
 
         /* compile the regex */
         p = bigpat ? bigpat : pat;
-        tmpbuf = NULL;
         re = slapi_re_comp(p, &re_result);
         if (NULL == re) {
             LDAPDebug(LDAP_DEBUG_ANY, "ldbm_search_compile_filter: re_comp (%s) failed (%s): %s\n",
                       pat, p, re_result?re_result:"unknown" );
             rc = SLAPI_FILTER_SCAN_ERROR;
         } else {
+            char ebuf[BUFSIZ];
             LDAPDebug(LDAP_DEBUG_TRACE, "ldbm_search_compile_filter: re_comp (%s)\n",
                       escape_string(p, ebuf), 0, 0);
             f->f_un.f_un_sub.sf_private = (void *)re;
@@ -1542,8 +1541,7 @@ ldbm_back_next_search_entry_ext( Slapi_PBlock *pb, int use_extension )
             Slapi_Value **refs= attr_get_present_values(attr);
             if ( refs == NULL || refs[0] == NULL )
             {
-                char ebuf[ BUFSIZ ];
-                LDAPDebug( LDAP_DEBUG_ANY, "null ref in (%s)\n", escape_string( backentry_get_ndn(e), ebuf ), 0, 0 );
+                LDAPDebug( LDAP_DEBUG_ANY, "null ref in (%s)\n", backentry_get_ndn(e), 0, 0 );
             }
             else if ( slapi_sdn_scope_test( backentry_get_sdn(e), basesdn, scope ))
             {
@@ -1604,8 +1602,7 @@ ldbm_back_next_search_entry_ext( Slapi_PBlock *pb, int use_extension )
                               ACL_CHECK_FLAG );
                       if (filter_test != ft_rc) {
                           /* Oops ! This means that we thought we could bypass the filter test, but noooo... */
-                          char ebuf[ BUFSIZ ];
-                          LDAPDebug( LDAP_DEBUG_ANY, "Filter bypass ERROR on entry %s\n", escape_string( backentry_get_ndn(e), ebuf ), 0, 0 );
+                          LDAPDebug( LDAP_DEBUG_ANY, "Filter bypass ERROR on entry %s\n", backentry_get_ndn(e), 0, 0 );
                           filter_test = ft_rc; /* Fix the error */
                       }
                   }
diff --git a/ldap/servers/slapd/back-ldbm/vlv.c b/ldap/servers/slapd/back-ldbm/vlv.c
index cf807ec..7172104 100644
--- a/ldap/servers/slapd/back-ldbm/vlv.c
+++ b/ldap/servers/slapd/back-ldbm/vlv.c
@@ -260,7 +260,6 @@ vlv_init_index_entry(Slapi_PBlock *pb, Slapi_Entry* entryBefore, Slapi_Entry* en
     struct vlvIndex* newVlvIndex;
     struct vlvSearch* pSearch;
     Slapi_Backend *be= ((ldbm_instance*)arg)->inst_be;
-    char ebuf[BUFSIZ];
 	
     if(be!=NULL)
     {
@@ -272,7 +271,7 @@ vlv_init_index_entry(Slapi_PBlock *pb, Slapi_Entry* entryBefore, Slapi_Entry* en
         pSearch= vlvSearch_finddn((struct vlvSearch *)be->vlvSearchList, &parentdn);
 		if (pSearch == NULL) { 
 			LDAPDebug( LDAP_DEBUG_ANY, "Parent doesn't exist for entry %s.\n",
-				escape_string(slapi_entry_get_dn(entryBefore), ebuf), 0, 0); 
+				slapi_entry_get_dn(entryBefore), 0, 0); 
 			vlvIndex_delete(&newVlvIndex);
 		} 
 		else { 
diff --git a/ldap/servers/slapd/bind.c b/ldap/servers/slapd/bind.c
index 4c3d25c..d725d5c 100644
--- a/ldap/servers/slapd/bind.c
+++ b/ldap/servers/slapd/bind.c
@@ -837,34 +837,29 @@ log_bind_access (
     const char *msg
 )
 {
-    char ebuf[ BUFSIZ ];
-    const char *edn;
-
-    edn = escape_string( dn, ebuf );
-
     if (method == LDAP_AUTH_SASL && saslmech && msg) {
         slapi_log_access( LDAP_DEBUG_STATS, 
                           "conn=%" NSPRIu64 " op=%d BIND dn=\"%s\" "
                           "method=sasl version=%d mech=%s, %s\n",
-                          pb->pb_conn->c_connid, pb->pb_op->o_opid, edn, 
+                          pb->pb_conn->c_connid, pb->pb_op->o_opid, dn, 
                           version, saslmech, msg );
     } else if (method == LDAP_AUTH_SASL && saslmech) {
         slapi_log_access( LDAP_DEBUG_STATS, 
                           "conn=%" NSPRIu64 " op=%d BIND dn=\"%s\" "
                           "method=sasl version=%d mech=%s\n",
-                          pb->pb_conn->c_connid, pb->pb_op->o_opid, edn, 
+                          pb->pb_conn->c_connid, pb->pb_op->o_opid, dn, 
                           version, saslmech );
     } else if (msg) {
         slapi_log_access( LDAP_DEBUG_STATS, 
                           "conn=%" NSPRIu64 " op=%d BIND dn=\"%s\" "
                           "method=%d version=%d, %s\n",
-                          pb->pb_conn->c_connid, pb->pb_op->o_opid, edn, 
+                          pb->pb_conn->c_connid, pb->pb_op->o_opid, dn, 
                           method, version, msg );
     } else {
         slapi_log_access( LDAP_DEBUG_STATS, 
                           "conn=%" NSPRIu64 " op=%d BIND dn=\"%s\" "
                           "method=%d version=%d\n",
-                          pb->pb_conn->c_connid, pb->pb_op->o_opid, edn, 
+                          pb->pb_conn->c_connid, pb->pb_op->o_opid, dn, 
                           method, version );
     }
 }
diff --git a/ldap/servers/slapd/compare.c b/ldap/servers/slapd/compare.c
index b5b28fb..5fb1d2f 100644
--- a/ldap/servers/slapd/compare.c
+++ b/ldap/servers/slapd/compare.c
@@ -70,7 +70,6 @@ do_compare( Slapi_PBlock *pb )
 	struct ava	ava = {0};
 	Slapi_Backend		*be = NULL;
 	int		err;
-	char		ebuf[ BUFSIZ ];
 	Slapi_DN sdn;
 	Slapi_Entry *referral = NULL;
 	char errorbuf[BUFSIZ];
@@ -145,8 +144,7 @@ do_compare( Slapi_PBlock *pb )
 
 	slapi_log_access( LDAP_DEBUG_STATS,
 	    "conn=%" NSPRIu64 " op=%d CMP dn=\"%s\" attr=\"%s\"\n",
-	    pb->pb_conn->c_connid, pb->pb_op->o_opid,
-	    escape_string( rawdn, ebuf ), ava.ava_type );
+	    pb->pb_conn->c_connid, pb->pb_op->o_opid, dn, ava.ava_type );
 
 	/*
 	 * We could be serving multiple database backends.  Select the
diff --git a/ldap/servers/slapd/configdse.c b/ldap/servers/slapd/configdse.c
index 4046563..12175c4 100644
--- a/ldap/servers/slapd/configdse.c
+++ b/ldap/servers/slapd/configdse.c
@@ -360,11 +360,9 @@ load_plugin_entry(Slapi_PBlock *pb, Slapi_Entry* e, Slapi_Entry* ignored, int *r
 		 */
 		if(retval)
 		{
-			char dnbuf[ BUFSIZ ];
-
 			slapi_log_error( SLAPI_LOG_FATAL, NULL,
 					"Unable to load plugin \"%s\"\n",
-					escape_string( slapi_entry_get_dn_const( e ), dnbuf ));
+					slapi_entry_get_dn_const( e ));
 			exit(1);
 		}
 	}
diff --git a/ldap/servers/slapd/delete.c b/ldap/servers/slapd/delete.c
index 693efa1..ced6351 100644
--- a/ldap/servers/slapd/delete.c
+++ b/ldap/servers/slapd/delete.c
@@ -251,7 +251,6 @@ static void op_shared_delete (Slapi_PBlock *pb)
 	char			*rawdn = NULL;
 	const char		*dn = NULL;
 	Slapi_Backend	*be = NULL;
-	char			ebuf[ BUFSIZ ];
 	int				internal_op;
 	Slapi_DN		*sdn = NULL;
 	Slapi_Operation *operation;
@@ -297,7 +296,7 @@ static void op_shared_delete (Slapi_PBlock *pb)
 			slapi_log_access(LDAP_DEBUG_STATS, "conn=%" NSPRIu64 " op=%d DEL dn=\"%s\"%s\n",
 							pb->pb_conn->c_connid, 
 							pb->pb_op->o_opid,
-							escape_string(slapi_sdn_get_dn(sdn), ebuf),
+							slapi_sdn_get_dn(sdn),
 							proxystr ? proxystr: "");
 		}
 		else
@@ -305,7 +304,7 @@ static void op_shared_delete (Slapi_PBlock *pb)
 			slapi_log_access(LDAP_DEBUG_ARGS, "conn=%s op=%d DEL dn=\"%s\"%s\n",
 							LOG_INTERNAL_OP_CON_ID,
 							LOG_INTERNAL_OP_OP_ID,
-							escape_string(slapi_sdn_get_dn(sdn), ebuf),
+							slapi_sdn_get_dn(sdn),
 							proxystr ? proxystr: "");
 		}
 	}
diff --git a/ldap/servers/slapd/entry.c b/ldap/servers/slapd/entry.c
index c235431..03ec117 100644
--- a/ldap/servers/slapd/entry.c
+++ b/ldap/servers/slapd/entry.c
@@ -326,12 +326,12 @@ str2entry_fast( const char *rawdn, char *s, int flags, int read_stateinfo )
 		}
 		if ( PL_strncasecmp( type.bv_val, "dn", type.bv_len ) == 0 ) {
 			if ( slapi_entry_get_dn_const(e)!=NULL ) {
-				char ebuf[ BUFSIZ ], ebuf2[ BUFSIZ ];
+				char ebuf[ BUFSIZ ];
 				LDAPDebug( LDAP_DEBUG_TRACE,
 					"str2entry_fast: entry has multiple dns \"%s\" and "
 					"\"%s\" (second ignored)\n",
-					escape_string( slapi_entry_get_dn_const(e), ebuf ),
-					escape_string( value.bv_val, ebuf2 ), 0 );
+					slapi_entry_get_dn_const(e),
+					escape_string( value.bv_val, ebuf ), 0 );
 				/* the memory below was not allocated by the slapi_ch_ functions */
 				if (freeval) slapi_ch_free_string(&value.bv_val);
 				continue;
@@ -853,12 +853,12 @@ str2entry_dupcheck( const char *rawdn, char *s, int flags, int read_stateinfo )
 		}
 		if ( strcasecmp( type, "dn" ) == 0 ) {
 			if ( slapi_entry_get_dn_const(e)!=NULL ) {
-				char ebuf[ BUFSIZ ], ebuf2[ BUFSIZ ];
+				char ebuf[ BUFSIZ ];
 				LDAPDebug( LDAP_DEBUG_TRACE,
 					"str2entry_dupcheck: entry has multiple dns \"%s\" "
 					"and \"%s\" (second ignored)\n",
-					escape_string( slapi_entry_get_dn_const(e), ebuf ),
-					escape_string( valuecharptr, ebuf2 ), 0 );
+					slapi_entry_get_dn_const(e),
+					escape_string( valuecharptr, ebuf ), 0 );
 				/* the memory below was not allocated by the slapi_ch_ functions */
 				if (freeval) slapi_ch_free_string(&bvvalue.bv_val);
 				continue;
@@ -3066,9 +3066,8 @@ slapi_entry_add_rdn_values( Slapi_Entry *e )
                 if ((ava.ava_value.bv_len != bv->bv_len) ||
                     (memcmp(ava.ava_value.bv_val, bv->bv_val, bv->bv_len) != 0)) {
                     /* bytes not identical so reject */
-                    char avdbuf[BUFSIZ];
                     LDAPDebug(LDAP_DEBUG_TRACE, "RDN value is not identical to entry value for type %s in entry %s\n", 
-                               type, dn ? escape_string(dn,avdbuf) : "<null>", 0 );
+                               type, dn ? dn : "<null>", 0 );
 #if 0
                     /* 
                      * This would be the right thing to do except that
diff --git a/ldap/servers/slapd/modify.c b/ldap/servers/slapd/modify.c
index 73752ed..da742da 100644
--- a/ldap/servers/slapd/modify.c
+++ b/ldap/servers/slapd/modify.c
@@ -636,7 +636,6 @@ static void op_shared_modify (Slapi_PBlock *pb, int pw_change, char *old_pw)
 	Slapi_Entry	*pse;
 	Slapi_Entry *referral;
 	Slapi_Entry	*e = NULL;
-	char ebuf[BUFSIZ];
 	char *dn = NULL;
 	char *normdn = NULL;
 	Slapi_DN *sdn = NULL;
@@ -704,7 +703,7 @@ static void op_shared_modify (Slapi_PBlock *pb, int pw_change, char *old_pw)
 			slapi_log_access(LDAP_DEBUG_STATS, "conn=%" NSPRIu64 " op=%d MOD dn=\"%s\"%s\n",
 							 pb->pb_conn->c_connid, 
 							 pb->pb_op->o_opid,
-							 escape_string(slapi_sdn_get_dn(sdn), ebuf),
+							 slapi_sdn_get_dn(sdn),
 							 proxystr ? proxystr : "");
 		}
 		else
@@ -712,7 +711,7 @@ static void op_shared_modify (Slapi_PBlock *pb, int pw_change, char *old_pw)
 			slapi_log_access(LDAP_DEBUG_ARGS, "conn=%s op=%d MOD dn=\"%s\"%s\n",
 							 LOG_INTERNAL_OP_CON_ID,
 							 LOG_INTERNAL_OP_OP_ID,
-							 escape_string(slapi_sdn_get_dn(sdn), ebuf),
+							 slapi_sdn_get_dn(sdn),
 							 proxystr ? proxystr : "");
 		}
 
@@ -1049,7 +1048,6 @@ static int op_shared_allow_pw_change (Slapi_PBlock *pb, LDAPMod *mod, char **old
 	Slapi_Entry *e = NULL;
 	passwdPolicy *pwpolicy;
 	int rc = 0;
-	char ebuf[BUFSIZ];
 	Slapi_Value **values= NULL;
 	Slapi_Operation *operation;
 	int proxy_err = LDAP_SUCCESS;
@@ -1081,7 +1079,7 @@ static int op_shared_allow_pw_change (Slapi_PBlock *pb, LDAPMod *mod, char **old
 		{
 			slapi_log_access(LDAP_DEBUG_STATS, "conn=%" NSPRIu64 " op=%d MOD dn=\"%s\"\n",
 					pb->pb_conn->c_connid, pb->pb_op->o_opid,
-					escape_string(slapi_sdn_get_dn(&sdn), ebuf));
+					slapi_sdn_get_dn(&sdn));
 		}
 
 		send_ldap_result(pb, proxy_err, NULL, errtext, 0, NULL);
@@ -1124,7 +1122,7 @@ static int op_shared_allow_pw_change (Slapi_PBlock *pb, LDAPMod *mod, char **old
 
 				slapi_log_access(LDAP_DEBUG_STATS, "conn=%" NSPRIu64 " op=%d MOD dn=\"%s\"%s\n",
 						pb->pb_conn->c_connid, pb->pb_op->o_opid,
-						escape_string(slapi_sdn_get_dn(&sdn), ebuf),
+						slapi_sdn_get_dn(&sdn),
 						proxystr ? proxystr : "");
 			}
 
@@ -1158,8 +1156,8 @@ static int op_shared_allow_pw_change (Slapi_PBlock *pb, LDAPMod *mod, char **old
 				}
 
 				slapi_log_access(LDAP_DEBUG_STATS, "conn=%" NSPRIu64 " op=%d MOD dn=\"%s\"%s, %s\n",
-	    						 pb->pb_conn->c_connid, pb->pb_op->o_opid,
-	    						 escape_string(slapi_sdn_get_dn(&sdn), ebuf), 
+							 pb->pb_conn->c_connid, pb->pb_op->o_opid,
+							 slapi_sdn_get_dn(&sdn),
 							 proxystr ? proxystr : "",
 							 "user is not allowed to change password");
 			}
@@ -1186,7 +1184,7 @@ static int op_shared_allow_pw_change (Slapi_PBlock *pb, LDAPMod *mod, char **old
 				slapi_log_access(LDAP_DEBUG_STATS, "conn=%" NSPRIu64 " op=%d MOD dn=\"%s\"%s, %s\n",
 								 pb->pb_conn->c_connid, 
 								 pb->pb_op->o_opid,
-								 escape_string(slapi_sdn_get_dn(&sdn), ebuf), 
+								 slapi_sdn_get_dn(&sdn),
 								 proxystr ? proxystr : "",
 								 "within password minimum age");
 			}
@@ -1195,7 +1193,7 @@ static int op_shared_allow_pw_change (Slapi_PBlock *pb, LDAPMod *mod, char **old
 				slapi_log_access(LDAP_DEBUG_ARGS, "conn=%s op=%d MOD dn=\"%s\"%s, %s\n",
 								 LOG_INTERNAL_OP_CON_ID,
 								 LOG_INTERNAL_OP_OP_ID,
-								 escape_string(slapi_sdn_get_dn(&sdn), ebuf), 
+								 slapi_sdn_get_dn(&sdn),
 								 proxystr ? proxystr : "",
 								 "within password minimum age");
 			}
@@ -1229,7 +1227,7 @@ static int op_shared_allow_pw_change (Slapi_PBlock *pb, LDAPMod *mod, char **old
 						slapi_log_access(LDAP_DEBUG_STATS, "conn=%" NSPRIu64 " op=%d MOD dn=\"%s\"%s, %s\n",
 										 pb->pb_conn->c_connid, 
 										 pb->pb_op->o_opid,
-										 escape_string(slapi_sdn_get_dn(&sdn), ebuf),
+										 slapi_sdn_get_dn(&sdn),
 										 proxystr ? proxystr : "",
 										"invalid password syntax");
 					}
@@ -1238,7 +1236,7 @@ static int op_shared_allow_pw_change (Slapi_PBlock *pb, LDAPMod *mod, char **old
 						slapi_log_access(LDAP_DEBUG_ARGS, "conn=%s op=%d MOD dn=\"%s\"%s, %s\n",
 										LOG_INTERNAL_OP_CON_ID,
 										LOG_INTERNAL_OP_OP_ID,
-										escape_string(slapi_sdn_get_dn(&sdn), ebuf),
+										slapi_sdn_get_dn(&sdn),
 										proxystr ? proxystr : "",
 										"invalid password syntax");
 					}
diff --git a/ldap/servers/slapd/modrdn.c b/ldap/servers/slapd/modrdn.c
index 98ab777..62c7f6a 100644
--- a/ldap/servers/slapd/modrdn.c
+++ b/ldap/servers/slapd/modrdn.c
@@ -429,9 +429,6 @@ op_shared_rename(Slapi_PBlock *pb, int passin_args)
 	Slapi_Backend	*be = NULL;
 	Slapi_DN		*origsdn = NULL;
 	Slapi_Mods		smods;
-	char			dnbuf[BUFSIZ];
-	char			newrdnbuf[BUFSIZ];
-	char			newsuperiorbuf[BUFSIZ];
 	int				internal_op, repl_op, lastmod;
 	Slapi_Operation *operation;
 	Slapi_Entry *referral;
@@ -510,9 +507,9 @@ op_shared_rename(Slapi_PBlock *pb, int passin_args)
 					 "conn=%" NSPRIu64 " op=%d MODRDN dn=\"%s\" newrdn=\"%s\" newsuperior=\"%s\"%s\n",
 					 pb->pb_conn->c_connid, 
 					 pb->pb_op->o_opid,
-					 escape_string(dn, dnbuf),
-					 (NULL == newrdn) ? "(null)" : escape_string(newrdn, newrdnbuf),
-					 (NULL == newsuperior) ? "(null)" : escape_string(newsuperior, newsuperiorbuf),
+					 dn,
+					 newrdn ? newrdn : "(null)",
+					 newsuperior ? newsuperior : "(null)",
 					 proxystr ? proxystr : "");
 		}
 		else
@@ -521,9 +518,9 @@ op_shared_rename(Slapi_PBlock *pb, int passin_args)
 					 "conn=%s op=%d MODRDN dn=\"%s\" newrdn=\"%s\" newsuperior=\"%s\"%s\n",
 					 LOG_INTERNAL_OP_CON_ID,
 					 LOG_INTERNAL_OP_OP_ID,
-					 escape_string(dn, dnbuf),
-					 (NULL == newrdn) ? "(null)" : escape_string(newrdn, newrdnbuf),
-					 (NULL == newsuperior) ? "(null)" : escape_string(newsuperior, newsuperiorbuf),
+					 dn,
+					 newrdn ? newrdn : "(null)",
+					 newsuperior ? newsuperior : "(null)",
 					 proxystr ? proxystr : "");
 		}
 	}
@@ -577,13 +574,13 @@ op_shared_rename(Slapi_PBlock *pb, int passin_args)
 				 "conn=%" NSPRIu64 " op=%d MODRDN invalid new superior (\"%s\")",
 				 pb->pb_conn->c_connid,
 				 pb->pb_op->o_opid,
-				 (NULL == newsuperior) ? "(null)" : newsuperiorbuf);
+				 newsuperior ? newsuperior : "(null)");
 		} else {
 			slapi_log_error(SLAPI_LOG_ARGS, NULL,
 				 "conn=%s op=%d MODRDN invalid new superior (\"%s\")",
 				 LOG_INTERNAL_OP_CON_ID,
 				 LOG_INTERNAL_OP_OP_ID,
-				 (NULL == newsuperior) ? "(null)" : newsuperiorbuf);
+				 newsuperior ? newsuperior : "(null)");
 		}
 		send_ldap_result(pb, LDAP_INVALID_DN_SYNTAX, NULL,
 						 "newSuperior does not look like a DN", 0, NULL);
diff --git a/ldap/servers/slapd/opshared.c b/ldap/servers/slapd/opshared.c
index 8d3e590..b0e45fb 100644
--- a/ldap/servers/slapd/opshared.c
+++ b/ldap/servers/slapd/opshared.c
@@ -173,7 +173,7 @@ void modify_update_last_modified_attr(Slapi_PBlock *pb, Slapi_Mods *smods)
             }
         }
         slapi_mods_add_modbvps(smods, LDAP_MOD_REPLACE | LDAP_MOD_BVALUES,
-       	                           "internalModifiersName", bvals);
+                                  "internalModifiersName", bvals);
 
         /* Grab the thread data(binddn) */
         slapi_td_get_dn(&binddn);
@@ -235,7 +235,6 @@ op_shared_search (Slapi_PBlock *pb, int send_result)
   Slapi_Backend   *be_single = NULL;
   Slapi_Backend   *be_list[BE_LIST_SIZE+1];
   Slapi_Entry     *referral_list[BE_LIST_SIZE+1];
-  char            ebuf[ BUFSIZ ];
   char            attrlistbuf[ 1024 ], *attrliststr, **attrs = NULL;
   int             rc = 0;
   int             internal_op;
@@ -355,7 +354,7 @@ op_shared_search (Slapi_PBlock *pb, int send_result)
           slapi_log_access(LDAP_DEBUG_STATS, fmtstr,
                            pb->pb_conn->c_connid, 
                            pb->pb_op->o_opid, 
-                           escape_string(normbase, ebuf),
+                           normbase,
                            scope, fstr, attrliststr,
                            flag_psearch ? " options=persistent" : "",
                            proxystr ? proxystr : "");
@@ -365,7 +364,7 @@ op_shared_search (Slapi_PBlock *pb, int send_result)
           slapi_log_access(LDAP_DEBUG_ARGS, fmtstr,
                            LOG_INTERNAL_OP_CON_ID,
                            LOG_INTERNAL_OP_OP_ID,
-                           escape_string(normbase, ebuf),
+                           normbase,
                            scope, fstr, attrliststr,
                            flag_psearch ? " options=persistent" : "",
                            proxystr ? proxystr : "");
@@ -1020,9 +1019,8 @@ process_entry(Slapi_PBlock *pb, Slapi_Entry *e, int send_result)
         slapi_attr_get_numvalues(a, &numValues );
         if (numValues == 0) 
         {
-            char ebuf[ BUFSIZ ];
-            LDAPDebug(LDAP_DEBUG_ANY, "null ref in (%s)\n",
-                      escape_string(slapi_entry_get_dn_const(e), ebuf), 0, 0);
+            LDAPDebug1Arg(LDAP_DEBUG_ANY, "null ref in (%s)\n",
+                          slapi_entry_get_dn_const(e));
         }
         else 
         {
@@ -1657,7 +1655,6 @@ send_results_ext(Slapi_PBlock *pb, int send_result, int *nentries, int pagesize,
 
 void op_shared_log_error_access (Slapi_PBlock *pb, const char *type, const char *dn, const char *msg)
 {
-    char ebuf[BUFSIZ];
     char *proxydn = NULL;
     char *proxystr = NULL;
 
@@ -1669,7 +1666,7 @@ void op_shared_log_error_access (Slapi_PBlock *pb, const char *type, const char
                       ( pb->pb_conn ? pb->pb_conn->c_connid : 0), 
                       ( pb->pb_op ? pb->pb_op->o_opid : 0), 
                       type, 
-                      escape_string( dn, ebuf ), 
+                      dn, 
                       proxystr ? proxystr : "",
                       msg ? msg : "" );
 
diff --git a/ldap/servers/slapd/psearch.c b/ldap/servers/slapd/psearch.c
index 0ba7b62..b5b4c3a 100644
--- a/ldap/servers/slapd/psearch.c
+++ b/ldap/servers/slapd/psearch.c
@@ -606,11 +606,10 @@ ps_service_persistent_searches( Slapi_Entry *e, Slapi_Entry *eprev, ber_int_t ch
 							eprev ? slapi_entry_get_dn_const(eprev) : NULL,
 							&ctrl );
 					if ( rc != LDAP_SUCCESS ) {
-						char ebuf[ BUFSIZ ];
 		   				LDAPDebug( LDAP_DEBUG_ANY, "ps_service_persistent_searches:"
 						" unable to create EntryChangeNotification control for"
 						" entry \"%s\" -- control won't be sent.\n",
-						escape_string( slapi_entry_get_dn_const(e), ebuf), 0, 0 );
+						slapi_entry_get_dn_const(e), 0, 0 );
 					}
 				}
 				if ( ctrl ) {
diff --git a/ldap/servers/slapd/pw.c b/ldap/servers/slapd/pw.c
index 2496c71..a6d6400 100644
--- a/ldap/servers/slapd/pw.c
+++ b/ldap/servers/slapd/pw.c
@@ -1539,7 +1539,6 @@ new_passwdPolicy(Slapi_PBlock *pb, const char *dn)
 	char *attr_name;
 	Slapi_Value **sval;
 	slapdFrontendConfig_t *slapdFrontendConfig;
-	char ebuf[ BUFSIZ ];
 	int optype = -1;
 
 	/* RFE - is there a way to make this work for non-existent entries 
@@ -1617,8 +1616,9 @@ new_passwdPolicy(Slapi_PBlock *pb, const char *dn)
 			slapi_entry_free( e );
 
 			if ( pw_entry == NULL ) {
-				LDAPDebug(LDAP_DEBUG_ANY, "loading global password policy for %s"
-					"--local policy entry not found\n", escape_string(dn, ebuf),0,0);
+				LDAPDebug1Arg(LDAP_DEBUG_ANY,
+				              "loading global password policy for %s"
+				              "--local policy entry not found\n", dn);
 				goto done;
 			}
         
diff --git a/ldap/servers/slapd/resourcelimit.c b/ldap/servers/slapd/resourcelimit.c
index e8403eb..ad8f5f1 100644
--- a/ldap/servers/slapd/resourcelimit.c
+++ b/ldap/servers/slapd/resourcelimit.c
@@ -441,12 +441,10 @@ reslimit_update_from_entry( Slapi_Connection *conn, Slapi_Entry *e )
 						rlcdp->rlcd_integer_value[ i ] );
 
 				if ( slapi_valueset_next_value( vs, index, &v ) != -1 ) {
-					char ebuf[ BUFSIZ ];
 					slapi_log_error( SLAPI_LOG_FATAL, SLAPI_RESLIMIT_MODULE,
 							"%s: ignoring multiple values for %s in entry %s\n",
 							fnname, reslimit_map[ i ].rlmap_at,
-							escape_string( slapi_entry_get_dn_const( e ),
-							ebuf ));
+							slapi_entry_get_dn_const( e ));
 				}
 			}
 
diff --git a/ldap/servers/slapd/result.c b/ldap/servers/slapd/result.c
index 4712ea1..09d6b90 100644
--- a/ldap/servers/slapd/result.c
+++ b/ldap/servers/slapd/result.c
@@ -1810,7 +1810,6 @@ static void
 log_entry( Operation *op, Slapi_Entry *e )
 {
 	int	internal_op;
-	char	ebuf[ BUFSIZ ];
 
 	internal_op = operation_is_flag_set( op, OP_FLAG_INTERNAL );
 
@@ -1818,7 +1817,7 @@ log_entry( Operation *op, Slapi_Entry *e )
 	{
 		slapi_log_access( LDAP_DEBUG_STATS2, "conn=%" NSPRIu64 " op=%d ENTRY dn=\"%s\"\n",
 			op->o_connid, op->o_opid,
-			escape_string( slapi_entry_get_dn_const(e), ebuf ));
+			slapi_entry_get_dn_const(e));
 	}
 	else
 	{
@@ -1826,7 +1825,7 @@ log_entry( Operation *op, Slapi_Entry *e )
 		{
 			slapi_log_access( LDAP_DEBUG_ARGS, "conn=%s op=%d ENTRY dn=\"%s\"\n",
 				LOG_INTERNAL_OP_CON_ID, LOG_INTERNAL_OP_OP_ID,
-				escape_string( slapi_entry_get_dn_const(e), ebuf ));
+				slapi_entry_get_dn_const(e));
 		}
 	}
 }
diff --git a/ldap/servers/slapd/sasl_map.c b/ldap/servers/slapd/sasl_map.c
index 792504d..7e7cfb8 100644
--- a/ldap/servers/slapd/sasl_map.c
+++ b/ldap/servers/slapd/sasl_map.c
@@ -578,7 +578,7 @@ sasl_map_check(sasl_map_data *dp, char *sasl_user_and_realm, char **ldap_search_
 					LDAPDebug( LDAP_DEBUG_TRACE,
 						"mapped base dn: %s, filter: %s\n",
 						escape_string( *ldap_search_base, escape_base ),
-					escape_string( *ldap_search_filter, escape_filt ), 0 );
+						escape_string( *ldap_search_filter, escape_filt ), 0 );
 					ret = 1;
 				}
 			}
diff --git a/ldap/servers/slapd/schema.c b/ldap/servers/slapd/schema.c
index 5f1438b..50b1cbc 100644
--- a/ldap/servers/slapd/schema.c
+++ b/ldap/servers/slapd/schema.c
@@ -470,10 +470,9 @@ slapi_entry_schema_check( Slapi_PBlock *pb, Slapi_Entry *e )
 
   /* find the object class attribute - could error out here */
   if ( (aoc = attrlist_find( e->e_attrs, "objectclass" )) == NULL ) {
-    char ebuf[ BUFSIZ ];
     LDAPDebug( LDAP_DEBUG_ANY,
 	       "Entry \"%s\" required attribute \"objectclass\" missing\n",
-	       escape_string( slapi_entry_get_dn_const(e), ebuf ), 0, 0 );
+	       slapi_entry_get_dn_const(e), 0, 0 );
 	if (pb) {
 		PR_snprintf( errtext, sizeof( errtext ),
 	       "missing required attribute \"objectclass\"\n" );
@@ -508,10 +507,9 @@ slapi_entry_schema_check( Slapi_PBlock *pb, Slapi_Entry *e )
     ocname = slapi_value_get_string(v);
 
     if ( !ocname ) {
-	char ebuf[ BUFSIZ ];
 	LDAPDebug( LDAP_DEBUG_ANY,
 	       "Entry \"%s\" \"objectclass\" value missing\n",
-	       escape_string( slapi_entry_get_dn_const(e), ebuf ), 0, 0 );
+	       slapi_entry_get_dn_const(e), 0, 0 );
 	if (pb) {
 		PR_snprintf( errtext, sizeof( errtext ),
 	       "missing \"objectclass\" value\n" );
@@ -536,7 +534,6 @@ slapi_entry_schema_check( Slapi_PBlock *pb, Slapi_Entry *e )
     } else {
       /* we don't know about the oc; return an appropriate error message */
       char			ebuf[ BUFSIZ ];
-      char			ebuf2[ BUFSIZ ];
 	  size_t		ocname_len = strlen( ocname );
 	  const char	*extra_msg = "";
 
@@ -550,12 +547,12 @@ slapi_entry_schema_check( Slapi_PBlock *pb, Slapi_Entry *e )
 
       LDAPDebug( LDAP_DEBUG_ANY,
 		 "Entry \"%s\" has unknown object class \"%s\"%s\n",
-		 escape_string( slapi_entry_get_dn_const(e), ebuf ),
-		 escape_string(ocname, ebuf2), extra_msg );
+		 slapi_entry_get_dn_const(e),
+		 escape_string(ocname, ebuf), extra_msg );
 	  if (pb) {
 		PR_snprintf( errtext, sizeof( errtext ),
 		"unknown object class \"%s\"%s\n",
-		 escape_string(ocname, ebuf2), extra_msg );
+		 escape_string(ocname, ebuf), extra_msg );
 		slapi_pblock_set( pb, SLAPI_PB_RESULT_TEXT, errtext );
 	  }
       unknown_class = 1;
@@ -611,10 +608,9 @@ slapi_entry_schema_check( Slapi_PBlock *pb, Slapi_Entry *e )
 	if ( slapi_attr_flag_is_set( a, SLAPI_ATTR_FLAG_SINGLE ) ) {
 	  if (slapi_valueset_count(&a->a_present_values) > 1)
 	    {
-	      char ebuf[ BUFSIZ ];
           LDAPDebug( LDAP_DEBUG_ANY,
 	         "Entry \"%s\" single-valued attribute \"%s\" has multiple values\n",
-			 escape_string( slapi_entry_get_dn_const(e), ebuf ),
+			 slapi_entry_get_dn_const(e),
 			 a->a_type, 0 );
 		  if (pb) {
 			PR_snprintf( errtext, sizeof( errtext ),
@@ -666,11 +662,10 @@ oc_check_required( Slapi_PBlock *pb, Slapi_Entry *e, struct objclass *oc )
         /* not there => schema violation */
         if ( a == NULL ) {
             char errtext[ BUFSIZ ];
-            char ebuf[ BUFSIZ ];
             LDAPDebug( LDAP_DEBUG_ANY,
                        "Entry \"%s\" missing attribute \"%s\" required"
                        " by object class \"%s\"\n",
-                       escape_string( slapi_entry_get_dn_const(e), ebuf ),
+                       slapi_entry_get_dn_const(e),
                        oc->oc_required[i], oc->oc_name);
             if (pb) {
                 PR_snprintf( errtext, sizeof( errtext ),
@@ -738,17 +733,16 @@ oc_check_allowed_sv(Slapi_PBlock *pb, Slapi_Entry *e, const char *type, struct o
     if ( 0 != rc ) {
       char errtext[ BUFSIZ ];
       char ebuf[ BUFSIZ ];
-      char ebuf2[ BUFSIZ ];
       LDAPDebug( LDAP_DEBUG_ANY,
          "Entry \"%s\" -- attribute \"%s\" not allowed\n",
-         escape_string( slapi_entry_get_dn_const(e), ebuf ),
-         escape_string( type, ebuf2 ),
+         slapi_entry_get_dn_const(e),
+         escape_string( type, ebuf ),
          0);
 
       if (pb) {
         PR_snprintf( errtext, sizeof( errtext ),
          "attribute \"%s\" not allowed\n",
-         escape_string( type, ebuf2 ) );
+         escape_string( type, ebuf ) );
         slapi_pblock_set( pb, SLAPI_PB_RESULT_TEXT, errtext );
       }
     }
@@ -4708,7 +4702,6 @@ va_expand_one_oc( const char *dn, Slapi_Value ***vap, const char *ocs )
 	struct objclass	*this_oc, *sup_oc;
 	int				p,i;
 	Slapi_Value		**newva;
-	char			ebuf[BUFSIZ];
 
 	this_oc = oc_find_nolock( ocs );
   
@@ -4750,7 +4743,7 @@ va_expand_one_oc( const char *dn, Slapi_Value ***vap, const char *ocs )
 	*vap = newva;
 	LDAPDebug( LDAP_DEBUG_TRACE,
 			"Entry \"%s\": added missing objectClass value %s\n",
-			escape_string( dn, ebuf ), sup_oc->oc_name, 0 );
+			dn, sup_oc->oc_name, 0 );
 }
 
 
diff --git a/ldap/servers/slapd/search.c b/ldap/servers/slapd/search.c
index 16ba40e..c3d51d6 100644
--- a/ldap/servers/slapd/search.c
+++ b/ldap/servers/slapd/search.c
@@ -427,10 +427,9 @@ free_and_return:;
 
 static void log_search_access (Slapi_PBlock *pb, const char *base, int scope, const char *fstr, const char *msg)
 {
-	char ebuf[BUFSIZ];
 	slapi_log_access(LDAP_DEBUG_STATS,
 					 "conn=%" NSPRIu64 " op=%d SRCH base=\"%s\" scope=%d filter=\"%s\", %s\n",
 					 pb->pb_conn->c_connid, pb->pb_op->o_opid, 
-					 escape_string(base, ebuf), scope, fstr, msg ? msg : "");
+					 base, scope, fstr, msg ? msg : "");
 
 }
-- 
1.7.7.6

