A nested if statement approximately 75 levels deep all because the author didn't understand that an ID can be unique. So he manually checked the value (which meant it could never be changed without a code change).

He did't understand the concept of a join. So he'd nest queries in VBScript with join key supplied from the outer query to the inner. Row by row. Essentially, a manual cursor.

Same programmer wrote an ASP portal app. The login of which got most of its security because they didn't know how to iterate over a returned dataset. Same code would set a cookie for access IN THE PRESENCE of a password. It could be wrong, you would still get access. Worse, the logout function didn't delete the access cookie, it just redirected you to the login page. Meaning you could impersonate anybody if knew thier username. Included admin.

I once corrected bug, by using a view. I sent him the view. He had no concept what a view was "That's like a stored procedure right?'. I'm shocked he knew what a stored procedure was.

He's still in business and the software is deployed worldwide. He refuses to fix it. He's a multi-millionaire.