I just started a position at a small 15-person clothing company where I am the ONLY technical person in the entire company. They had a freelance web dev for the past 10 years who just left and they wanted a full-time software engineer.

The current codebase is an absolute mess. It's in php, it's got just as much commented out code as uncommented code, and the only comments in english are "// not sure why this works - don't touch it"

The system is pretty big and after speaking with everyone they were asking for dynamic features that don't play well with php and codeigniter's static page design. I made the executive decision that if I was inheriting the codebase and I am going to be working on it for the next X years, it's appropriate to do a rewrite.

I let them know it would take 5-6 months and they said "okay". I have checkins every week where I tell some guy who's in charge of marketing that I did lots of configuration and he says "okay, keep it up". Every week I make a small amount of progress on this new site, and every week I find something terrifying about the old site that I'm not sure how to fix. The auth guards are really buggy, no user input is being sanitized, and applying a 15% off coupon on something that costs $19.99 will break everything.

I could use some advice on where to focus my efforts. Should I be solving these issues with the old site before I move on? Should I deal with it until the new stuff is ready. Should I split my time between both evenly? Has anyone been in a situation like this before?