I've re-read your post a few times and I'm not quite sure I follow it all.
However i'm concerned that your coder needed to change the directory to get his code to work ... so I'd wonder about the quality of the rest. Smacks of the newbie coding I did 8 years ago
He also hasn't used internal vB database handling which is simpler but doesn't utilise some of the safeguards vB has provided.
Can
"getenv(REMOTE_ADDR)" be hacked? Can it be used for an injection? You might want to check that too.