Someone asked me to take over maintaining their (quite old) website. I looked at the code, and I see that every page has calls to
mysql_query, with sql strings concatenated with completely unsanitized
$_GET variables. It's a huge website, and would need to be rewritten from scratch to get rid of all these problems. I'm assuming that they've never experienced any attacks, or they would have mentioned it.
Should I tell them about it, and if so, what should I say?