In reply to mark k..

@Mark K

I would patiently explain to them that their site is running on an insecure version of php, and any security measures that I or any other developer may attempt to harden their site from malicious players is just p!$$!ng in the wind.

That if they insist on running an insecure site they are very likely going to be breached at some point and this could be a very very costly mistake.

I would also ask them to find another developer because I do not want anything to do with the potential risk. If they are breached and their site gets a bad reputation I don't want to be anywhere near it.