Replacing a PHP 5 app after its developer leaves in Berlin (2026)

The verdict in three sentences

A PHP 5 application with no security patch since 2018 is an open door, and the departure of its only developer turns that technical risk into an operational risk. The right sequence starts with an audit at 3,500 to 7,000 EUR that maps code, data and real usage. Then comes a progressive rewrite at 45,000 to 130,000 EUR, module by module, which avoids a big bang and keeps the business running.

Measure the risk before pricing

PHP 5.6 has received no patch since January 2019. On an Internet-facing server, every month without updates increases exposure to known vulnerabilities. The second risk is human: nobody knows where the business rules live, and every outage becomes an investigation.

The audit must answer four questions: what the application really does (often 30% of screens are no longer used), which data is critical, which interfaces exist with accounting or ERP, and which emergency measures secure the existing system during the rewrite.

The three options and their 2026 cost

The progressive rewrite, known as the strangler pattern, places a common entry point in front of the old application, then replaces modules one at a time. Each delivered module goes live and the matching old code is switched off. The risk of total failure drops sharply, and the company can stop or redirect the project at each step.

Migrating 10 years of history

This is often the most underestimated item: 15 to 25% of the total budget. Ten years of data contain duplicates, repurposed fields, mixed encodings (Latin-1 and UTF-8) and implicit rules. Plan for replayable migration scripts, automated comparison of totals (revenue, stock, customer counts) and at least two dress rehearsals before switching each module. Under GDPR, the migration is also the right moment to purge data past its retention period.

Mini case study

Julia, managing director of a 45-person industrial maintenance SME in Berlin, depends on a PHP 5 application that runs service calls, contracts and invoicing. The developer, on staff since 2009, has retired.

• Audit: 5,000 EUR, revealing that 12 of 38 screens are no longer used.
• Emergency hardening: 3,500 EUR.
• Progressive rewrite of 4 modules: 76,000 EUR over 9 months, including 15,000 EUR of data migration.
• Cost avoided: a 5-day outage without invoicing means about 65,000 EUR of delayed revenue, and a customer data breach would expose the company to a GDPR fine.

At 84,500 EUR total plus 700 EUR a month maintenance, the project costs less than a salaried developer over 18 months, while delivering documented and tested code.

FAQ

Can we keep the current application a few more years?

Technically yes with network isolation, but every month adds risk. Beyond 12 to 18 months, the cost of an outage or breach generally exceeds the cost of the rewrite.

Should we hire an in-house developer instead?

An experienced PHP developer in Berlin costs 65,000 to 85,000 EUR a year fully loaded, and recreates the same single-person dependency. An external team with documentation and tests reduces that risk.

How do we avoid losing business rules hidden in the code?

The audit includes interviews with 4 to 6 key users and a code reading of sensitive calculations (prices, discounts, due dates). Each rule is recorded and tested in the new version.

Will users have to change their habits?

Little, if the rewrite keeps the main workflows. Count 2 to 4 hours of training per delivered module.

Who owns the new code?

The company, through an assignment of rights in the contract, with source code in its own repository and technical documentation.

Let's scope your project. Describe your application, its age and its usage: we start with a 3,500 to 7,000 EUR audit delivered in 2 to 3 weeks, then a module-by-module rewrite plan priced between 45,000 and 130,000 EUR. Detailed quote within 48 h. WhatsApp +221 77 596 93 33.