The early versions of PHP automatically extracted $_POST, $_GET and $_COOKIE arrays as variables.

This made programming with PHP super easy as one could define variables in a form and use them in a script.

They deprecated this feature because PHP programmers were lazy about initializing variables. Specifically, there was a code base that did something like:

if ($user_pwd = $stored_pwd) {
  $hasAccess = 1;
}

if ($has_access == 1) {
  // hand user keys to kingdom
}

If a hacker called the code with ?has_access=1 in the URL, then they could get the keys to the kingdom.

!WINE