I recently started server-side programming, and wrote up a page containing a drawable-canvas that lets users publically draw and save a picture, and overwrite pictures made by others.

For kicks, I thought of advertising the link on social media to see what happens. I'd rather not put my computer in harm's way though just for kicks.

My main concerns are someone being able to access the rest of my system, or being able to delete files off the site.

Are either of these a concern?

Quick information about the setup:


I'm using XAMPP 7.0.1 on Windows 10 Home. Besides putting a password on my MySQL server, I really haven't done anything security oriented, so it could be considered in an "out-of-the-box" state as far as security is concerned.
It uses a MySQL database and PHP's MySQLi library, but as mentioned above, I have it password protected, and have taken care to prevent injection.


Oh my. YES! All those things are of a concern. You only expose your server publicly if you are prepared to have that server taken over by a malicious party. 

All one needs to do is to find a misconfiguration or a security hole and they can own your personal computer that you use to do things like access personal accounts (email, banks, etc.).

Public servers need to be locked down, with only the info it needs to provide a service. Best case is to have that server backed up and disposable in case it is compromised. If something bad happens, you blow it away and restore from back ups.

Do not expose your personal computer to the public in this way, especially when you are exposing custom code and you do not understand how exploitable it is.
