Exercise 1: Compiling "Hello, <%= name %>!" by Hand — Possible Solution
====================================================================

THE PATTERN TO FOLLOW
------------------------------
The chapter's own real example, from Ruby's own ERB documentation, shows
'The time is <%= Time.now %>.' compiling to:

    _erbout = +''; _erbout.<< "The time is ".freeze; _erbout.<<(( Time.now ).to_s); _erbout.<< ".".freeze; _erbout

Three real rules are visible in that generated code:
  1. Every literal chunk of text becomes a frozen Ruby string, appended
     onto the accumulator with <<.
  2. Every <%= expr %> becomes ( expr ).to_s, also appended onto the
     accumulator -- nothing more is done to the value.
  3. The accumulator itself is the final expression, so its own value
     becomes the method's real return value.

APPLYING IT TO "Hello, <%= name %>!"
------------------------------
The template splits into three real pieces, in order: the literal text
"Hello, ", the expression name, and the literal text "!". Following the
identical three rules above:

    _erbout = +''; _erbout.<< "Hello, ".freeze; _erbout.<<(( name ).to_s); _erbout.<< "!".freeze; _erbout

WHAT THE MISSING ESCAPING CALL MEANS
------------------------------
Look at step 2 again: the compiled code calls .to_s on name and appends
it directly -- there is no call to anything resembling html_escape,
CGI.escapeHTML, or any other escaping function anywhere in this
generated source. If name contained real markup (a value like
"<script>alert(1)</script>"), that markup would be appended into
_erbout completely intact, exactly the way Chapter 4's own original,
vulnerable render() function behaved before it was rebuilt with
auto-escaping.

That means plain ERB -- the real Ruby standard-library class, used on
its own, outside of Rails -- does NOT protect against this by default.
The "ERB / Rails" row in the chapter's own big comparison table is a
real, accurate description of using ERB *inside a Rails application*,
where Rails' own ActionView layer wraps additional escaping logic
around ERB's own <%= %> output tag. Someone using Ruby's plain ERB
class directly, with no Rails involved, gets exactly the compiled code
shown above -- and is fully responsible for escaping any untrusted
value themselves before it ever reaches the template.

WHY THIS WORKS AS AN ANSWER
----------------------------
It follows the chapter's own real, quoted example mechanically rather
than guessing at Ruby syntax, correctly applies its three-rule pattern
to a different literal/expression/literal template shape, and draws
the real, verified conclusion the missing escaping call actually
supports: ERB itself is unsafe by default, and Rails' own real
escaping behavior is a framework-level addition sitting on top of it,
not a feature of ERB.