Check, check, and check. Add to that no version control, no tests, no development environment, a custom ajax frontend framework, and the fact that it was mission critical. About the only thing it had going for it was daily database backups (which came in handy).
I did my best to clean up the code so it was at least somewhat maintainable, but there were sections (the most important ones, of course) that I just wouldn't touch because it was impossible to tell what they did -- oh yeah, I forgot to mention the global variables, didn't I?
We had a similar situation but with an ASP application that got rewritten from scratch in PHP instead. It's still running fine after 10 years without any big bugs. We didn't even get access to the sourcecode so it was all new bugs instead but at least it wasn't a big security hole whose database got wiped every week because of Bobby Tables. It had daily backups though that came in handy every week :-)
I did my best to clean up the code so it was at least somewhat maintainable, but there were sections (the most important ones, of course) that I just wouldn't touch because it was impossible to tell what they did -- oh yeah, I forgot to mention the global variables, didn't I?
So happy that app is dead and buried.