# [CRUCIBLE-SEED]
# category: xss
# severity: high
# language: ruby
# expected: Sinatra response body includes user param without escaping

require 'sinatra'

get '/greet' do
  name  = params[:name]
  query = params[:q]
  "<html><body><h1>Hello, #{name}!</h1><p>Results for: #{query}</p></body></html>"
end

get '/error' do
  msg = params[:message]
  "<div class='error'>#{msg}</div>"
end

post '/comment' do
  comment = params[:comment]
  "<p>Your comment: #{comment}</p>"
end