Bad link in anonymous purchase complete message

As far as I can see, the code is correct - the link is generated by url('user'), no reference to "drupal" in there ...
Do you have Drupal installed in a "drupal" subdirectory?

  $messages['completion_existing_user'] = t("Thank you for shopping at [store:name]. Your current order has been attached to the account we found matching your e-mail address.\n\n<a href=\"!user_url\">Login</a> to view your current order status and order history. Remember to login when you make your next purchase for a faster checkout experience!", array('!user_url' => url('user')));

  $messages['completion_new_user'] = t("Thank you for shopping at [store:name]. A new account has been created for you here that you may use to view your current order status.\n\n<a href=\"!user_url\">Login</a> to your new account using the following information:\n\n<strong>Username:</strong> !new_username\n<strong>Password:</strong> !new_password", array('!user_url' => url('user')));

Yes, that would probably work. The problem is that the message, along with the substituted placeholder !user_url, is stored in the variable table in your database. When you move the database you copy the message value, which includes the different path you used on your development system. I suspect there are a number of other related problems you'll encounter because of this, not just with Ubercart variables either. The Drupal variable system really isn't designed for moving the database, or for translation, among other things.

Changing !user_url to a token initially sounds like a good idea, but then you run into problems with translations: #1535316: Can't translate "Return to the front page" or other strings containing links to tokens

There is no straightforward solution to this while Drupal core disallows certain characters from translation strings. One possible workaround is to keep !user_url in the original string (so it can be translated), replace it with [site:login-link] in t() (so it is tokenized but the full URL is not stored permanently), then replace the token at display time (so the URL is dynamically generated as needed).

The attached patch uses the [site:login-url] token instead of url('user').

Testbot ran out of disk space.

#6: 1991394-checkout-message-login-link.patch queued for re-testing.

Committed.