I've done this. You have my sympathy. If your passport isn't current or for some other reason you can't dodge doing this, here's how I'd approach it:
Step Zero is to get it into version control, no matter how crappy it is. If it even kind of works, and you break something, you need to be able to go back to the working state - or at least compare your changes to it to figure out what went wrong. Do frequent, small check-ins as you're refactoring, and you'll have less code to roll back when things mysteriously go wrong. (Things WILL mysteriously go wrong.)
After that, I'd start at the database. Make sure everything is relatively well-normalized, columns are clearly named, etc.
Do the PHP code next. If the code is really that much of a patchwork, I'd go ahead and fit it to a framework. Look into CakePHP or Symfony - their Rails-ish manner of separating concerns makes the question "where should this piece of code go?" easy to answer. It's not a small task, but once you've done it, you're probably better than half-way to having a sanely-constructed app. Also, the built-in test facilities of a good web framework make refactoring FAR easier - write a test to cover an existing piece of functionality before you change it, and you'll know whether you broke anything after the change.
Once you've got your database sorted and have the model code in the models and the controller code in the controllers, then you can worry about presentation-level stuff like standardizing on a single JS/AJAX library, cleaning up CSS, etc.
As for a dev environment: You should absolutely set up a local dev environment. There are turnkey WAMP packages out there, or you could install to a Linux box/VM (I recommend VirtualBox for virtualization). You should also have a separate integration test environment that mimics the live server. Nothing but live code should run on the live server.
As far as debug/profiling tools, I know that Symfony comes with a pretty slick set of tools, including a little JS toolbar that comes up on your pages (only in debug mode) with logging & profiling information.
Good luck.