How do you approach working on a legacy PHP codebase with no tests and outdated practices?

The answer they are screening against is "rewrite it". Show you can improve incrementally.

• Get it running locally and under version control first. Surprisingly often that is the real first task.
• Add characterisation tests around what you must touch. Not a full suite — just enough to know whether your change altered behaviour. These tests document what the code does, which may differ from what anyone thinks it does.
• Fix security before style. SQL built by string concatenation, unescaped output, and an unsupported PHP version are urgent. Inconsistent brace placement is not.
• Upgrade PHP one version at a time, using a static analyser such as PHPStan or Rector to find what will break before it does.
• Introduce structure at the edges. Composer for autoloading, then move logic into classes as you touch it, rather than in a dedicated refactor nobody will approve.

Note: The strangler pattern is worth naming: route new features through a modern framework alongside the legacy application and migrate pages gradually, so the old system shrinks instead of being replaced in one risky push.