Legacy Modernization · AI-Assisted Engineering · Pulse Software Solutions
The SOS Call
At Pulse Software Solutions, we specialize in breathing new life into existing software. A client recently reached out about a critical PHP component originally built by a previous vendor. It was functional, but only barely. Slow page loads, ballooning server costs, security findings, and code that nobody wanted to touch. This was not a polish job. It was a rescue.
We turned to a powerful ally to accelerate the work: artificial intelligence. Below is how we used AI alongside our engineering team to diagnose the real problems, ship the fixes, and hand back an application the client could grow with.
Jump To Section
Step 1
The client arrived with a clear, urgent list of concerns about the PHP component running a core part of their business.
Users were waiting unacceptably long on data-heavy screens. Frustration was up, productivity was down.
CPU and memory consumption were excessive, driving up hosting bills and putting the platform at real risk of crashing during peak hours.
A preliminary audit had flagged SQL injection risks in the way the original code built database queries. No breach yet, but the warning signs were clear.
The code was poorly structured and hard to follow. Every new feature or bug fix was a slow, risky exercise.
As users and records multiplied, the slowness and memory pressure were getting exponentially worse.
In short, an application that was supposed to be an asset had quietly become a bottleneck, a security liability, and a brake on the client’s growth.
Step 2
We started with a thorough code review. The root causes mirrored common patterns we see in legacy PHP applications, and they explained almost every symptom the client was reporting.
SQL was being built by concatenating strings, a serious security risk and a recipe for slow execution.
Redundant copies of data were consuming memory with no real purpose.
SQL conditions were hardcoded throughout the codebase, making the system rigid and hard to debug.
Inefficient loops and calculations were copy-pasted across files, multiplying the surface area of every bug.
Step 3
We knew we could improve the code. The question was how to do it both quickly and effectively for a system this large. We brought an AI-powered code analysis assistant into the workflow, essentially a tireless senior reviewer that could read code at scale and flag risks our team could then validate and act on.
We fed targeted snippets to the AI and asked sharply scoped questions about performance, security, and maintainability. Every suggestion was reviewed, tested, and adapted by our engineers before it ever touched the client’s codebase. AI did the heavy lifting on detection. Humans owned the judgment.
Step 4
Here are four of the most impactful changes, each compared side by side. These patterns alone accounted for a large share of the performance and security gains.
Building the WHERE clause by gluing user input into a SQL string with implode(). Readable only if you wrote it. Exploitable if anyone touches the input.
An array-based WHERE clause handed to the framework, which generates a parameterized query. Safe, readable, and the database planner can optimize it cleanly.
Parameterized queries separate the SQL code from the data, so a hostile value cannot escape its slot and change the meaning of the statement. That single change eliminated an entire class of vulnerability across the codebase and made the queries faster as a side benefit.
A foreach loop walked every record and pushed a single column into a brand new array. Fine on 100 rows. Painful on 100,000.
PHP’s built-in array_column() does the same job in one call, with significantly less memory pressure and far fewer lines of code.
Forcing the relational database to run heavy, search-style queries it was never designed to handle.
We moved the relevant data to Elasticsearch and introduced a dedicated model. Search-style queries went to a search engine, where they belong, and the SQL database got room to breathe.
Pulling every row across the wire into PHP, looping through it, and computing an average in application code.
A single average() call executed directly on the database server. Only the final number travels back to PHP.
Databases are highly optimized for aggregations. Letting them do that work cut both processing time and network traffic at the same time.
Step 5
Performance was only half the story. The AI helped us surface security gaps that needed equal attention, and our team built and verified the fixes.
String-concatenated SQL was the headline risk. Switching every affected query to parameterized statements closed the door on injection across the application.
The AI flagged spots where user-supplied data could reach the page without proper handling. We added rigorous input validation and output encoding so malicious JavaScript could not be injected and executed in other users’ browsers.
User inputs were trusted far too readily. We added validation rules that enforce expected formats and ranges, which doubles as a defense against bad data and as a stability win.
The Numbers
The scope of the engagement, in concrete terms.
Touch points across the codebase where changes landed.
From roughly 93,000 lines down to about 81,000. Simpler, leaner, and easier to read.
Every change reviewed by a human engineer before merging.
Including the move from string-built SQL to parameterized queries.
Including the core Abilities model, the new AbilitiesElastic search model, and related controllers.
Covering SQL injection, XSS exposure, and weak input validation.
From roughly 80% during query execution down to about 20%. Fewer string operations, database-side calculations, and smarter data fetching.
From around 500MB down to roughly 100MB. Removing redundant variables and replacing loops with array_column() did the heavy lifting.
From around 5 seconds on key pages down to about half a second. Better queries, Elasticsearch for search workloads, and far less PHP overhead.
From “vulnerable, hard to read, painful to maintain” to a parameterized, well-structured codebase the client’s own team can confidently extend.
Key Takeaways
Do not wait for an outage or an audit finding to drive cleanup. Regular reviews catch problems while they are still cheap to fix.
Parameterized queries, validated inputs, and encoded outputs are not optional. They are the price of admission for any modern web application.
AI shines at scanning large codebases and surfacing patterns. Senior engineers still own the architecture, the tradeoffs, and the final call.
Search workloads belong on a search engine. Aggregations belong on the database. PHP should orchestrate, not muscle through.
Try This Yourself
You do not need a full rescue engagement to get value from AI-assisted code review. A focused, disciplined workflow goes a long way.
Use a profiler such as Xdebug in PHP to point at the real hot paths. Optimize what is actually slow, not what you think might be.
Pull out the specific function or block you want to improve so the AI can reason about it without drowning in surrounding noise.
Strong prompts include “Optimize this PHP for performance and security,” “Rewrite this SQL query to prevent SQL injection,” “Reduce memory usage in this loop,” and “Refactor for readability and maintainability.”
Never paste a suggestion in blind. Read it, question it, and make sure you can explain why it is better than what was there.
AI-suggested changes still need real coverage. Always test behavior, performance, and security before shipping.
Conclusion
Pulse Software Solutions turned a struggling, insecure PHP component into a fast, secure, and maintainable asset the client now feels comfortable building on. By combining hands-on engineering with AI-assisted code analysis, we delivered a result that exceeded the original brief, and we did it in a fraction of the time a manual rewrite would have taken.
If you are sitting on a legacy application that is slowing your team down or keeping your security team up at night, this same approach can work for you too. Modernization does not have to mean a ground-up rewrite. See how we approach the full AI-driven software development process and let us help you turn that liability back into an asset.
Tell us where it hurts. Performance, security, maintainability, or all three. We will show you what AI-assisted modernization can do for your codebase.
© 1998-