Situation:

LAN with a server PC, where I have my own "HTTP-server" (written in Delphi). The user is a waiter, using a smartphone. The icon on the smartphone simply connects to the IP+Port of the PC. The 'HTTP-server' on the PC on the first connection sends a full HTML page as a response. The page stays for the whole duration of the session. 

The HTML downloaded to the smartphone contains a login DIV, and then various DIV's which will be populated with the response from the 'HTTP-server' on the PC and hidden/shown accordingly.

The request on the HTML page is sent as POST. The server will create an HTML response according to the parameters sent in the POST request and the client will populate the appropriate DIV with it. 

There is only one user input, for a note. Whatever is written there is sent 'as is' to the server which will return that text to be loaded in the appropriate DIV on the client-side.

I tried to see if this lent itself to malicious injections by writing "Alert('HACK')" in it;. What happens is that the server responds by sending the string back and the client loads it literally as a note in the correct DIV. 

From my understanding, this setup should be safe. Am I wrong? Perhaps there is some mysterious way a hacker (sitting where?? how would he be coming into play?) can still crash the app?