Working in legacy systems
Modernized a live PHP site in place, with no rewrite, no bundler, and no broken flows.
Live · legacy modernization
Prime Standard legacy modernization
Full-stack developer
Most real engineering happens on top of something that already runs. This was a live FrontAccounting/PHP site: table-based markup, vendored webmail and calendar apps, no bundler, and no chance of a rewrite. I modernized the look, added a real feature, and hardened the forms, all without breaking the routes and email flows people depended on every day.
PHPVanilla JS (ES5)Progressive enhancementPDF generationMicrosoft Graph APISecurity hardening
- System
- Legacy PHP · no bundler
- Approach
- Progressive enhancement
- Feature
- Invoice generator + PDF
- IFTA refactor
- 2×1,700 → 31 lines
The problem
The site was a production legacy system: no build pipeline, legacy inline scripts, and forms, routes, and email flows that real users relied on. I couldn't drop in React, add a bundler, or rewrite the data layer. The work had to modernize the UI, add real features, and close security gaps in place, without breaking anything already running.
What I owned
Three connected bodies of work: a shared design system and progressive-enhancement retrofit across every public page, an end-to-end invoice generator with a server-authoritative tax engine and a from-scratch PDF writer, and a hardened form layer, capped by an IFTA refactor that collapsed two 1,700-line processors into thin orchestrators behind one shared library.
The hard parts
- Enhancing a table-based site that had no bundler. The base is semantic HTML that works without JS, with a themed layout rebuilt on top.
- Getting money math right: integer-only currency end to end, with the server recomputing every total so the client is never trusted.
- Hardening live forms with CSRF, honeypots, output escaping, and injection-safe mail, all without changing the field names and POST targets people depended on.
The result
Modernized a live legacy system in place: a coherent themed UI with full dark/light parity, a working invoice tool with reproducible, date-versioned tax math, and a hardened form layer, all dropping into the existing site with a single script tag and no build step.
How it fits together
- 01
Semantic HTML
Static, accessible markup that still works with JavaScript disabled.
- 02
Progressive enhancement
A dependency-free ES5 script rebuilds the header, nav, footer, and theme toggle on top, over a centralized color-token layer with dark/light parity that coexists with the legacy stylesheet.
- 03
Invoice client
A vanilla-JS UI computes live totals purely for feel. Quantities, prices, and provinces are all it ever posts.
- 04
Server tax engine
PHP recomputes every subtotal and tax line from the raw payload with integer-only money math and date-versioned Canadian rates, so historical invoices stay reproducible.
- 05
PDF + email
A from-scratch PDF-1.4 writer renders the invoice, and Microsoft Graph delivers it.
- 06
Hardened forms
Timing-safe CSRF, a honeypot, allowlist validation, and injection-safe mail, with the original field names and POST targets preserved. Two 1,700-line IFTA processors collapsed to 31 lines each behind a shared library.
Skills it proves
Feature ownership
Built an invoice generator end to end: server-authoritative, integer-only tax math and a from-scratch PDF writer.
Security & refactoring
Hardened live forms and collapsed two 1,700-line IFTA processors into thin orchestrators behind one shared library.
Want the rest of the story?