A PHP/MySQL-driven online contact management system, where the contact table did not have a natural key. There were numerous instances of database fields containing composite data in the form of a delimited string that subsequently needed to be parsed by application code.
The HTML and logic were intertwined, almost no functions were used, but rather code was cut and pasted into dozens of source code files. Data was not sanitized and so fields with (e.g.) embedded vertical tabs caused the XML returned by Ajax calls to malfunction, and to top it all off, files with dozens if not hundreds of empty statements consisting of closing braces immediately followed by semi-colons: "};"