verify: only escape 'name', not prefix+name