If I want to accept donations on a website, what risk is there in showing bank account number and sort code?
Assuming you are talking about personal accounts not company accounts here. It's part of your identity and you should protect it as much as possible, risk is greater if they can find your address (fairly easy - online address finders, whois records if you own the website) or your date of birth.
There was a case a few years ago where a UK celebrity claimed nothing could be done with their acct no / sort code and published them in the press - a stranger used their details to set up a direct debit to a charity. link to source (BBC)
Although you might have a number of trusted customers - your details will be available to anyone who can get to your site and some of those may be malicious. If you are in the UK, the direct debit guarantee may cover you if any one set up anything like that but your bank may consider it reckless to post your details in public. I certainly would be very uncomfortable doing so and would consider a payment gateway instead.
I think I could pay my car payment with just that information.
You could use PayPal for this kind of venture.