fixed one more vulnerability in the NAMES regex