Oh lawd. The stories I could tell from my past 2 years.
The last company I worked for had one client who was an autodealer. You could apply for car loans online by filling out a form with all of your personal details - including social insurance number - which would be emailed to a number of people once you clicked "submit". I hadn't even worked on the project since I was a new hire at the time but suddenly found myself getting automated emails with people's SINs in PLAIN TEXT. My boss didn't understand why this was wrong and never convinced the client to fix it.
While that's pretty bad from a legal/security standpoint, the woman I was replacing due to maternity leave left me some pretty interesting/terrorizing code snippets to gawk at and attempt to fix. Most noteworthy was the custom CMS she built from scratch over the course of 2 months that she had proudly proclaimed to be "idiot proof".
Let's say you are a club owner and you want to schedule an event that people can purchase tickets for. On any other CMS (content management system), you would click "Add Event" and fill in the details. Not this system, though.
First, you have to go to the photo gallery area of the admin dashboard and upload a photo of the act you are booking. Once you save this photo, you can then classify the photo itself as a type of show/event. Once that's saved, you can fill out a form with all the details, adding more events for the same person/act this way.
That's not where the fun ends though! Oh ho ho no. Upon submission, the inputted answers on the form are turned into a list/array and saved with the photo into one giant list within another list. For example, if you want to refer to the name of the act on the public ticket purchasing page, you would have to grab it by the order that the item is supposed to be in, like thisAct[1][5]. The first [1] stands for which event you want details from and the [5] is the position where the name of the act is supposed to be saved within that event. Except she goofed up something in the saving process of the events and it didn't always save in the correct order for some reason (the lead developer had to fix this later). It's been a whole year and the site is still having emergencies on a weekly basis.
Oh, and she documented nothing.
I'm happy I work for a much better company with coding standards in place nowadays :)