I found one of these once for a client I was doing some work for. It was an Ecommerce site as well and they had the "brilliant" idea of "solving" SQL injection

I found one of these once for a client I was doing some work for. It was an Ecommerce site as well and they had the "brilliant" idea of "solving" SQL injection by exiting early and stopping the page from loading if the URL contained an apostrophe... One URL encoded apostrophe later and 45 minutes wrangling T-SQL and I had a neat URL to show them at our next meeting with CCname in it. For added fun, they used Authorize.net but instead of just storing a transaction ID in their infinite brilliance they decided to store name, number, expiry, and CVV code! They didn't even have user accounts or saved payments, it was all more or less a guest checkout flow for all their orders so customers couldn't even look this up on their site after the transaction. Once an order had been filled there wasn't even any usage of the old order data and they never deleted any of it. A quick row count showed ~750,000 entries going back for years. People that do things like filtering all apostrophes in a form send shivers up my spine. God only knows what horrors lurk beneath the surface on that California government site.