Other folks on this thread have great advice. I've been in this situation too. Probably everyone at one time in their career walked into a project that looks like it was hit by a tornado.
One suggestion I'd add is that before you do any of the cleanup described by other folks, you need to get management buy-in.
- Make a plan based on suggestions on this thread.
- Describe any new hardware or software you'll need to create a development & testing environment, and price these out.
- Figure out which new skills you need to be trained on to set up and use the development & testing environment. Estimate the time and expenses required for you to get those skills. E.g. books or paid training.
- Estimate a work schedule for you to do the cleanup. How long to get the code under source control? How long to understand the database? How long to understand the PHP and javascript code?
- Present this to your manager, and phrase the goal in terms of benefit to his bottom line. E.g. once everything is cleaned up, making changes or rolling out new functionality will be quicker, debugging errors will be more predictable, and ramping up new staff will be easier.
Naturally you need to continue to work with the current mess, because it's a live site. Managing the live site takes priority, so cleanup work must be a background task. That means it'll take even longer. My experiences cleaning up a moderate-sized project as a background task have usually taken six to twelve months. Since the site will continue to evolve over this period, some of your completed cleanup tasks may need to be revised or re-done. Make sure your manager understands all this too.
If the manager balks at your plan to clean up this mess, or doesn't value cleaning it up, at least then you'll know why all the other developers have left this company!
I have a few specific suggestions about how to proceed:
- In addition to all the other great advice, I'd suggest using the Joel Test as a benchmark. Your plan for cleanup should result in a job environment that would score well on the Joel Test.
- Read my answer to "What are the best ways to understand an unfamiliar database?"
- Enable logging on the website so you can analyze which PHP pages are actually being called. At least that tells you which of index2.php, index3.php, index4.php, etc. are truly obsolete.
- PHP has a function get_included_files() that returns an array of all files included during the current request. By logging this information, you can find out which PHP files are in use, even if they don't show up in the web server log.
- You really do need to have a testing & development environment that matches your production server. It's no good to test on Windows and deploy on Linux. It's no good to use MySQL 5.0 during development and MySQL 4.0 in production. You can probably get away with a hardware platform that is more modest (though compatible).