register_globals was removed several years ago;
mysql_* functions all have a big red warning at the top of the docs pages warning users not to use it;
extract has a big red warning about using it on untrusted data.
PHP shouldn't hold developer's hands, but it does enough to warn them away from the Here There Be Dragons.