Retrofitting a Legacy University Admission Test into an Item Response Theory-Based Adaptive Test: Code Audit, Monte Carlo Simulation and a Lightweight PHP Engine

Many Indonesian private universities deliver admission examinations as computer-based tests that give every applicant the same fixed form, while computerized adaptive testing is held back by cost, infrastructure and expertise. This study examines whether the web-based admission test of Universitas Muhammadiyah Sukabumi can be retrofitted into an item response theory-based adaptive test on its existing PHP and SQL stack. A static code audit found that 16 of 17 raw database queries embed request variables, 14 of 55 controller methods read or modify applicant data without any authentication check, passwords are stored in plaintext, the 120-minute timer runs only in a browser cookie, and no response times are recorded. A Monte Carlo study under the two-parameter logistic model (three subtests, 20 replications, 1,000 simulees each, banks of 50, 100 and 200 items per subtest) showed that, at an equal length of 20 items, the adaptive test lowered the root mean square error of ability estimates by 16% to 29% relative to a linear form. Matching the precision of the current 50-item form required 32.7 items (35% fewer) with a 100-item bank and 26.0 items (48% fewer) with a 200-item bank, whereas a 50-item bank gave only a 21% saving at slightly lower precision. Randomesque selection reduced maximum item exposure to as low as 0.78 at a cost of at most 0.004 in error. A PHP implementation reproduced the reference implementation exactly in 1,500 simulated sessions and served each item in under 1 ms (median) for banks of up to 1,000 items. Retrofitting is feasible, but its benefit depends on expanding the item bank to at least 100 items per subtest and on fixing the identified security weaknesses.