I'm building this web app where users can login and build their own online presentation. To build the presentation they can use their own html, css and javascript. These user files are not uploaded to the server of the web app (where also the login using PHP sessions is done on a separate SSL domain) but the files are uploaded to Amazon S3. When a user wants to upload he needs an registered user account before they can start building and uploading. Every user have their own unique domain name on which they build and login.

The HTML files are being read by PHP and used in a template engine to build and show the public presentation page (sort of a website). The javascrpt is linked in the HTML.

Hope you can help me out! I'd like to know if this is a secure setup or are their any risks I need to solve. I've read a lot about different security issues and hope this setup solves a lot. Of course a user is self responsible for the public site, but I'm responsible for the central web app and like to know if they can hack the central system using the uploaded HTML and javascript