diff --git a/br/pkg/conn/conn.go b/br/pkg/conn/conn.go
index fbe72886c128a..0f24857e954cb 100644
--- a/br/pkg/conn/conn.go
+++ b/br/pkg/conn/conn.go
@@ -7,6 +7,7 @@ import (
 	"crypto/tls"
 	"encoding/json"
 	"fmt"
+	"net"
 	"net/http"
 	"net/url"
 	"strings"
@@ -387,7 +388,7 @@ func handleTiKVAddress(store *metapb.Store, httpPrefix string) (*url.URL, error)
 	// but in sometimes we may not get the correct status address from PD.
 	if statusUrl.Hostname() != nodeUrl.Hostname() {
 		// if not matched, we use the address as default, but change the port
-		addr.Host = nodeUrl.Hostname() + ":" + statusUrl.Port()
+		addr.Host = net.JoinHostPort(nodeUrl.Hostname(), statusUrl.Port())
 		log.Warn("store address and status address mismatch the host, we will use the store address as hostname",
 			zap.Uint64("store", store.Id),
 			zap.String("status address", statusAddr),
diff --git a/ddl/ddl_tiflash_api.go b/ddl/ddl_tiflash_api.go
index 17dce94cf6f1a..79ccb2523e118 100644
--- a/ddl/ddl_tiflash_api.go
+++ b/ddl/ddl_tiflash_api.go
@@ -24,7 +24,8 @@ import (
 	"context"
 	"encoding/json"
 	"fmt"
-	"strings"
+	"net"
+	"strconv"
 	"time"
 
 	"github.com/pingcap/errors"
@@ -263,9 +264,8 @@ func getTiflashHTTPAddr(host string, statusAddr string) (string, error) {
 	if !ok {
 		return "", errors.New("Error json")
 	}
-	port := int(port64)
 
-	addr := fmt.Sprintf("%v:%v", host, port)
+	addr := net.JoinHostPort(host, strconv.FormatUint(uint64(port64), 10))
 	return addr, nil
 }
 
@@ -294,11 +294,11 @@ func LoadTiFlashReplicaInfo(tblInfo *model.TableInfo, tableList *[]TiFlashReplic
 
 // UpdateTiFlashHTTPAddress report TiFlash's StatusAddress's port to Pd's etcd.
 func (d *ddl) UpdateTiFlashHTTPAddress(store *helper.StoreStat) error {
-	addrAndPort := strings.Split(store.Store.StatusAddress, ":")
-	if len(addrAndPort) < 2 {
-		return errors.New("Can't get TiFlash Address from PD")
+	host, _, err := net.SplitHostPort(store.Store.StatusAddress)
+	if err != nil {
+		return errors.Trace(err)
 	}
-	httpAddr, err := getTiflashHTTPAddr(addrAndPort[0], store.Store.StatusAddress)
+	httpAddr, err := getTiflashHTTPAddr(host, store.Store.StatusAddress)
 	if err != nil {
 		return errors.Trace(err)
 	}
diff --git a/infoschema/cluster.go b/infoschema/cluster.go
index 2977c1c770144..44b7e1cdc5a62 100644
--- a/infoschema/cluster.go
+++ b/infoschema/cluster.go
@@ -15,6 +15,7 @@
 package infoschema
 
 import (
+	"net"
 	"strconv"
 	"strings"
 
@@ -148,7 +149,7 @@ func GetInstanceAddr(ctx sessionctx.Context) (string, error) {
 	if err != nil {
 		return "", err
 	}
-	addr := serverInfo.IP + ":" + strconv.FormatUint(uint64(serverInfo.StatusPort), 10)
+	addr := net.JoinHostPort(serverInfo.IP, strconv.FormatUint(uint64(serverInfo.StatusPort), 10))
 	if sem.IsEnabled() {
 		checker := privilege.GetPrivilegeManager(ctx)
 		if checker == nil || !checker.RequestDynamicVerification(ctx.GetSessionVars().ActiveRoles, "RESTRICTED_TABLES_ADMIN", false) {
diff --git a/privilege/privileges/ldap/ldap_common.go b/privilege/privileges/ldap/ldap_common.go
index 36e06e2d5ac68..fe869efe71faf 100644
--- a/privilege/privileges/ldap/ldap_common.go
+++ b/privilege/privileges/ldap/ldap_common.go
@@ -18,7 +18,9 @@ import (
 	"crypto/tls"
 	"crypto/x509"
 	"fmt"
+	"net"
 	"os"
+	"strconv"
 	"sync"
 
 	"github.com/go-ldap/ldap/v3"
@@ -119,7 +121,7 @@ func (impl *ldapAuthImpl) initializeCAPool() error {
 }
 
 func (impl *ldapAuthImpl) connectionFactory() (pools.Resource, error) {
-	address := fmt.Sprintf("%s:%d", impl.ldapServerHost, impl.ldapServerPort)
+	address := net.JoinHostPort(impl.ldapServerHost, strconv.FormatUint(uint64(impl.ldapServerPort), 10))
 
 	// It's fine to load these two TLS configurations one-by-one (but not guarded by a single lock), because there isn't
 	// a way to set two variables atomically.
diff --git a/store/copr/coprocessor.go b/store/copr/coprocessor.go
index 4231a7d0a9658..aa1329e89445d 100644
--- a/store/copr/coprocessor.go
+++ b/store/copr/coprocessor.go
@@ -18,6 +18,7 @@ import (
 	"context"
 	"fmt"
 	"math"
+	"net"
 	"strconv"
 	"strings"
 	"sync"
@@ -576,7 +577,7 @@ func buildTiDBMemCopTasks(ranges *KeyRanges, req *kv.Request) ([]*copTask, error
 			continue
 		}
 
-		addr := ser.IP + ":" + strconv.FormatUint(uint64(ser.StatusPort), 10)
+		addr := net.JoinHostPort(ser.IP, strconv.FormatUint(uint64(ser.StatusPort), 10))
 		tasks = append(tasks, &copTask{
 			ranges:       ranges,
 			respChan:     make(chan *copResponse, 2),
diff --git a/util/processinfo.go b/util/processinfo.go
index eee5b8fe020b7..d7e2e7c15ea83 100644
--- a/util/processinfo.go
+++ b/util/processinfo.go
@@ -18,6 +18,7 @@ import (
 	"crypto/tls"
 	"errors"
 	"fmt"
+	"net"
 	"strings"
 	"sync/atomic"
 	"time"
@@ -85,7 +86,7 @@ func (pi *ProcessInfo) ToRowForShow(full bool) []interface{} {
 	}
 	var host string
 	if pi.Port != "" {
-		host = fmt.Sprintf("%s:%s", pi.Host, pi.Port)
+		host = net.JoinHostPort(pi.Host, pi.Port)
 	} else {
 		host = pi.Host
 	}