Modernising old PHP and legacy software, with code and security review
Old software that still earns its keep is an asset with a risk attached. We upgrade it in careful, tested steps, so you keep what works and remove what is dangerous, without switching the business off.
What we build
Many useful business applications were written years ago for PHP 5.x or 7.x, or for platforms such as Visual Basic or Access. They still work. But those versions no longer receive security fixes, newer servers refuse to run them, and the gap grows each year. Modernising moves the application to a supported platform so it can be hosted, patched and maintained again.
We help you choose the least risky route. Sometimes it is an in-place upgrade, for example to a supported PHP 8. Sometimes it is a move to a modern stack and a cloud or managed server. Sometimes it is wrapping the old system with an API and replacing it piece by piece. A full rewrite is the last option, not the first. Before we change anything, we write tests around the behaviour that matters, so we can show the application does the same thing afterwards.
A code and security review is a separate service you can take alone or before an upgrade. A software developer reads your code, configuration and dependencies and returns a written report, ranked by risk and effort, with a suggested fix for each finding. It is not a formal penetration test and not a compliance audit. If you need either, an accredited specialist is the right choice.
Where it helps
Unsupported versions and security risk
Old PHP, .NET or database versions no longer receive security fixes, and any flaw found in them stays open.
Hosting that will no longer run the application
Providers retire old versions. We upgrade the code so you can move to current hosting instead of staying on a frozen server.
Software only one person understands
With no documentation or tests, every change feels risky. We document and stabilise it.
Desktop programs that cannot go online
Programs tied to one PC or office network can be moved to a web model.
Code nobody has reviewed
Applications grow for years without a second pair of eyes. A review shows what is there, and in what order to fix it.
What you get
- A written assessment of the current system: code, data, hosting and risks
- A staged plan, with the option to stop after any stage
- Tests written around the important behaviour before any change is made
- The upgraded application, with updated libraries and database access code, checked at each step
- A rehearsed switch-over with a way back, so the live application keeps running
- A code and security review report, ranked by risk and effort, with a prioritised fix list
- Optional fixing of the findings and a follow-up review round
Technology
- PHP 5.x and 7.x (source)
- PHP 8 (target)
- Composer
- Laravel and Symfony
- C# / .NET
- VB / VB.NET
- MySQL / MariaDB
- PostgreSQL
- SQL Server
- Automated tests (PHPUnit)
- Static analysis
- Dependency checks
- Linux
- Docker
- Git
The upgraded application can run on our cloud or managed servers if you want that, but you are never required to use them.
From brief to handover
Every project starts with a short brief and a written quote. How a software project starts.
- 01 · BRIEF
You tell us what the software must do, who uses it and which systems it must work with. The form takes five minutes.
- 02 · QUOTE
We ask our questions, then send a written quote: scope, milestones, price in rupees + 18% GST and the payment schedule.
- 03 · BUILD
We build in milestones and you review each one. Changes in scope are agreed in writing first.
- 04 · HANDOVER
You get the code, the access details and the documentation, then support from us if you want it.
Modernisation and code review: questions
Should we rewrite or modernise?
Usually modernise in stages. A rewrite throws away tested business rules and delays the benefit. We suggest a rewrite only when the existing foundation cannot be saved.
Which PHP version do you upgrade to?
A PHP 8 version that is still supported at the time of the work. We confirm the choice with you, because it depends on your libraries and hosting.
Will the application go offline during the upgrade?
We plan for it not to. The work happens in a separate copy, and the switch-over is set for a quiet period with a tested way back.
Can you work with code that has no documentation?
Yes. We document as we go, so the knowledge no longer sits in one head.
What does the code review cover, and can you fix what you find?
The application code, its dependencies, its configuration and, if you wish, the server it runs on. We agree the scope at the start. You can take the fix list to your own developers, or ask us to make the fixes.
How do you price and take payment?
We do not publish prices. After a short brief we send a written quote. Payment is by IT Labs India invoice with a payment link, and GST at 18% is added.
Related services
Maintenance and support
We look after software you already have: fixes, updates and small changes. You can also take a developer on a monthly basis.
Custom software
Workflow tools and internal software shaped around your own process, in the language and stack that suits the job.
Integrations
APIs, payment gateways and UPI, and SMS, WhatsApp and email messaging, connected so that data moves on its own.
Tell us what you need
A short brief is enough. We reply with questions or a written quote, without obligation.