Since this is a normal script on the server / workspace, you cannot get the local player since there is no local player. Server applies to everyone, not a single player. You would need to change that to a specifics players name or another method that applies to your game.
You could pass a Changed event of a :GetPropertyChangedSignal event for the textbox in the PlayerGui (Make sure this is used in a local script, not a server side script). In the event, you can fire a Remote event filtering text script on the server so the player doesn’t type anything inappropriate. It will then filter the text and make the surface GUI visible to everybody by setting the surface GUI text to the filtered text. If you need a little demo of how this would look, I would love to help you out
Correct. The server allows everybody in the game to see what you are passing. That is why it is very important to limit the amount of data being sent from the Client to the Server to prevent exploitation