phos

  - Custom wrapper around MySQLi, which doesn't support parametrized queries
  - No separation of Model, View and Controller (in 10 lines, there's SQL, HTML, JS, PHP and if you get lucky, PHP generating JS or piecing together HTML)
  - Their idea of IRC integration is to write a bot in PHP, where different pages send it raw IRC commands to execute
  - is_numeric used for most SQL injection checks
  - User information stored in two tables (users_main, users_info), for no apparent reason
  - About 1/3 of the code is in a file named script_start.php, which defines a mess of global variables and functions
  - They store PHP-serialized data in MySQL TEXT fields
  - They store pipe-separated data in MySQL TEXT fields