At what point do I start suggesting changes?
Follow standard operating procedure:
- Point out what you think could be improved right away. If they don't agree with you, move on to step two.
- Do the job as instructed, but consider creating alternatives to the scripts on your own time. Give them something a little more real. "This is the current script, this is how it can be exploited to deface our website. Should I replace it with the new version?"
- If step two does not provide the desired results, decide whether or not you really want to work there.
Best of luck :).