My first web app was functionally very similar, right down to being vulnerable to XSS[1] and someone exploiting that vulnerability soon after I shared it. At least that’s what I’m assuming happened here, and that you’re not intentionally redirecting visitors to an adult site. Don’t let it get you down though! (I know I did at first, it’s understandable.) Take it as a learning experience, and make your web app better by (at least) sanitizing user input. Good luck!
1: https://en.m.wikipedia.org/wiki/Cross-site_scripting