I'm going to make an assumption that it was a PHP app written internally by people that didn't know what they were doing, with no documentation, and that was fragile as all hell. Also probably written in some ancient php version that could not be upgraded and was a huge security risk.
Check, check, and check. Add to that no version control, no tests, no development environment, a custom ajax frontend framework, and the fact that it was mission critical. About the only thing it had going for it was daily database backups (which came in handy).
I did my best to clean up the code so it was at least somewhat maintainable, but there were sections (the most important ones, of course) that I just wouldn't touch because it was impossible to tell what they did -- oh yeah, I forgot to mention the global variables, didn't I?
We had a similar situation but with an ASP application that got rewritten from scratch in PHP instead. It's still running fine after 10 years without any big bugs. We didn't even get access to the sourcecode so it was all new bugs instead but at least it wasn't a big security hole whose database got wiped every week because of Bobby Tables. It had daily backups though that came in handy every week :-)
