At least they had "use strict" turned on. Not sure why they weren't using DBI and placeholders to prevent SQL injection attacks in 2005.