The verdict in three sentences
A PHP 5 application built in 2009 that nobody fully understands any more is a security risk and a commercial brake, but replacing it in one go is rarely the best option. A full rewrite costs about 80,000 to 140,000 EUR in Dublin and freezes feature work for 8 months, while progressive modernisation using the strangler pattern costs about 60,000 to 95,000 EUR over 12 months and keeps the business running. The decision should follow an initial audit of around 5,000 EUR that measures what can be saved.
Why PHP 5 cannot wait
PHP 5.6 has not received a security patch since 31 December 2018. An order, stock and invoicing application still running on it usually carries several problems: deprecated MySQL extensions, a server stuck on an old Linux release, no tests, and an original developer long gone. For a Dublin wholesaler supplying hygiene products to hospitals, hotels and facilities firms, a data breach or ransomware attack is not theoretical, and the GDPR enforcement of the Irish Data Protection Commission makes the exposure very real.
| Observed risk | Consequence for the wholesaler | Urgency |
|---|---|---|
| PHP 5 unpatched since 2018 | Known exploitable flaws, cyber insurance refused or pricier | High |
| Outdated server and OS | Cannot install modern components | High |
| No automated tests | Every change breaks something else | Medium |
| Code known by one person | Full stop if they leave | High |
| No API | No customer portal, no e-invoicing link | Medium, rising with EU e-invoicing |
| Non-responsive interface | Field sales with no mobile access | Medium |
The EU push toward structured e-invoicing (ViDA, and public sector buyers in Ireland already receiving EN 16931 invoices) adds a constraint: the application must exchange structured data. A PHP 5 app without an API will not do that cleanly.
Rewrite or strangler: the numbers
The strangler pattern puts a routing layer in front of the old application, then replaces modules one at a time (catalogue, orders, invoicing, stock). Each new module goes live as soon as it is ready while the old code is switched off piece by piece.
| Criterion (2026 order of magnitude, ex VAT) | Full rewrite | Progressive modernisation |
|---|---|---|
| Budget | 80,000 to 140,000 EUR | 60,000 to 95,000 EUR |
| Duration | 8 months | 12 months, in 6 to 10 week batches |
| Feature freeze | Yes, throughout | No, every batch delivers value |
| Cutover risk | High, single go-live | Low, module by module |
| First visible gain | Month 8 | Month 2 or 3 |
| Data migration | One shot, high risk | Progressive, verifiable |
| When it is the right call | Unsalvageable code, inconsistent database | Sound database, reliable business rules |
A rewrite still makes sense when the audit shows an inconsistent database or contradictory business rules. In other cases, the majority for a tool that has worked for 17 years, progressive modernisation is cheaper and far less risky.
What a 5,000 EUR audit contains
A serious audit takes 5 to 8 days: inventory of modules and tables, measurement of the functionality actually used (often 40% of the code is never called), vulnerability scan, mapping of flows with accounting and carriers, then a roadmap split into batches with a cost per batch. The deliverable lets you compare quotes on a common basis.
At Kolonell, this kind of modernisation is scoped as a custom application of medium complexity, 6,100 to 10,670 EUR, or complex, 10,670 to 22,870+ EUR, with the batch plan set in the quote. A maintenance contract then follows at 53, 114 or 183 EUR a month. See also our cybersecurity offer.
Mini case study
Siobhan, managing director of a hygiene products wholesaler in Dublin (35 staff, 1,900 orders a month), compares both options after the audit.
Need a professional website?
Kolonell builds websites that attract clients, optimized for the Sénégalese market. Free quote in 2 minutes.
- Rewrite: 110,000 EUR, 8-month freeze. The planned customer portal is postponed. It should move 40% of orders to self-service and save 25 hours of data entry a week at 35 EUR loaded cost, about 3,500 EUR a month. Lost savings over 8 months: 28,000 EUR. Real cost: 138,000 EUR.
- Strangler: 78,000 EUR in 5 batches. The customer portal ships first, in month 3. Savings over the remaining 9 months of year one: 31,500 EUR. Net year-one cost: 46,500 EUR.
The gap exceeds 90,000 EUR in favour of progressive modernisation. Siobhan starts the audit, then batch 1 (routing layer and customer portal).
FAQ
Can we just upgrade from PHP 5 to PHP 8?
Rarely without effort: the mysql_* functions were removed in PHP 7 and much syntax changed. An upgrade often needs 15 to 30 days of fixes, to be assessed in the audit.
How much does a legacy application audit cost?
As a 2026 order of magnitude in Dublin, 4,000 to 7,500 EUR for 5 to 8 days, with a costed deliverable per batch.
Does the strangler pattern suit a small team?
Yes, even better: each 6 to 10 week batch is validated by users before the next, and the budget can be spread over 12 months.
What should we do while waiting?
Isolate the server, restrict access through a VPN, set up daily off-site backups and a web application firewall. These cost a few hundred euros a month and cut the risk sharply.
Does e-invoicing force a rebuild?
It forces at least an API or a connector to an e-invoicing provider. That is often the right first batch of a modernisation.
Let's scope your project. We audit your application, cost each modernisation batch and plan a schedule with no interruption to orders. Detailed quote within 48 h. WhatsApp +221 77 596 93 33.
Mohamed Bah
Fondateur, Kolonell
Passionate about digital and entrepreneurship in Africa, Mohamed has been helping Sénégalese businesses with their digital transformation since 2020. Founder of Kolonell, he believes every SME deserves a professional and accessible online présence.
