diff --git a/src/strings.c b/src/strings.c
index 9b66ee0..6b2ff0a 100644
--- a/src/strings.c
+++ b/src/strings.c
@@ -269,12 +269,12 @@
 		*d++ = *p++;
 		continue;
 	    }
-	    if (do_special && find_cmdline_var(p, &l) >= 0 && l > 0)
+	    if (do_special && find_cmdline_var(p, &l) >= 0)
 	    {
 		*d++ = '\\';		// insert backslash
-		do			// copy the var
-		    *d++ = *p++;
-		while (--l > 0);
+		memcpy(d, p, l);	// copy the var
+		d += l;
+		p += l;
 		continue;
 	    }
 	    if (*p == '\\' && fish_like)
diff --git a/src/structs.h b/src/structs.h
index b5341e3..804581b 100644
--- a/src/structs.h
+++ b/src/structs.h
@@ -4795,7 +4795,7 @@
 typedef struct spat
 {
     char_u	    *pat;	// the pattern (in allocated memory) or NULL
-    size_t	    patlen;	// the length of the patten (0 is pat is NULL)
+    size_t	    patlen;	// the length of the pattern (0 if pat is NULL)
     int		    magic;	// magicness of the pattern
     int		    no_scs;	// no smartcase for this pattern
     soffset_T	    off;
diff --git a/src/testdir/test_shell.vim b/src/testdir/test_shell.vim
index 7d91dff..2ac5596 100644
--- a/src/testdir/test_shell.vim
+++ b/src/testdir/test_shell.vim
@@ -158,6 +158,10 @@
   call assert_equal("'te\\#xt'", shellescape("te#xt", 1))
   call assert_equal("'te!xt'", shellescape("te!xt"))
   call assert_equal("'te\\!xt'", shellescape("te!xt", 1))
+  call assert_equal("'te<cword>xt'", shellescape("te<cword>xt"))
+  call assert_equal("'te\\<cword>xt'", shellescape("te<cword>xt", 1))
+  call assert_equal("'te<cword>%xt'", shellescape("te<cword>%xt"))
+  call assert_equal("'te\\<cword>\\%xt'", shellescape("te<cword>%xt", 1))
 
   call assert_equal("'te\nxt'", shellescape("te\nxt"))
   call assert_equal("'te\\\nxt'", shellescape("te\nxt", 1))
diff --git a/src/version.c b/src/version.c
index bedc35b..e90bd30 100644
--- a/src/version.c
+++ b/src/version.c
@@ -705,6 +705,8 @@
 static int included_patches[] =
 {   /* Add new patch number below this line */
 /**/
+    451,
+/**/
     450,
 /**/
     449,