# [CRUCIBLE-SEED]
# category: xss
# severity: medium
# language: ruby
# expected: ERB template rendered with user string directly substituted

require 'erb'

def render_template(template_string, user_data)
  ERB.new(template_string).result(binding)
end

def personalize_email(user_name, promo_code)
  template = "Hello <%= user_name %>, your promo code is: <%= promo_code %>"
  ERB.new(template).result(binding)
end

def build_page(title, body, footer)
  tmpl = "<html><head><title><%= title %></title></head><body><%= body %><footer><%= footer %></footer></body></html>"
  ERB.new(tmpl).result(binding)
end