Judging what you have.
WHAT TO LOOK FOR
The PHP version required Whether queries are parameterised Whether output is escaped Where credentials are stored Whether uploads are handled safely Whether errors are displayed
WHAT TO PRIORITISE
Security faults, above everything.
WHAT TO CHECK IMMEDIATELY
Whether configuration files are publicly reachable Whether backups sit in the public directory Whether debug output is visible
THOSE THREE
Frequently present, and immediately exploitable.
WHAT TO ASSESS ABOUT STRUCTURE
Whether logic and markup are separated Whether code is duplicated extensively Whether there is any structure at all
WHAT TO ESTIMATE
Whether it is worth improving or worth replacing.
WHAT FAVOURS IMPROVING
It works, it is understood, and the business depends on it.
WHAT FAVOURS REPLACING
An unsupported PHP version it cannot leave Fundamental security problems throughout Nobody able to understand it
WHAT TO DO EITHER WAY
Fix the security faults first.
