- Custom wrapper around MySQLi, which doesn't support parametrized queries
- No separation of Model, View and Controller (in 10 lines, there's SQL, HTML, JS, PHP and if you get lucky, PHP generating JS or piecing together HTML)
- Their idea of IRC integration is to write a bot in PHP, where different pages send it raw IRC commands to execute
- is_numeric used for most SQL injection checks
- User information stored in two tables (users_main, users_info), for no apparent reason
- About 1/3 of the code is in a file named script_start.php, which defines a mess of global variables and functions
- They store PHP-serialized data in MySQL TEXT fields
- They store pipe-separated data in MySQL TEXT fields