Automatically updating someone else's code is more difficult than it seems. Any Python project of significant complexity will need manual adjustment before or after passing it through 2to3, and even then you'll need to perform a lot of tests to make sure that everything behaves as expected. Similarly, the upgrade wizard in .NET always breaks a thing or two. I would expect a PHP upgrade wizard to fare no better.
For example, PHP allows you to keep the name of a function in a variable and call it as if it were an anonymous function. So you can do something like:
$h = 'htmlspecialchars';
echo $h(''); // <script>
Of course, it's probably a bad idea to do this unless you really have no other option. (By the way, the above example is
not how Lithium uses $h. But we can easily imagine a lame imitator doing the above.) But given that some programs do rely on features like this, how would you update them automatically if you decided to change the way htmlspecialchars() works?
Things get even more complicated when functions change in more subtle ways. If a function that used to return FALSE on failure is updated to throw an exception instead, an automated tool would have to wrap every function call with a try-catch block, with potentially unexpected side effects. If a function that used to take strings in the system charset by default is updated to take UTF-8 all the time, you'll have to throw in some code for charset conversion before every occurrence of that function, but some servers might not have mbstring/iconv installed and turn that into a fatal error.
A better solution is actually what PHP has been doing for the last few minor versions: deprecating stupid functions like mysql_real_escape_string() and encouraging people to migrate to modern alternatives. Once a function is marked as deprecated, it will be removed in a few years. This process takes longer, but it gives everyone enough time to update their own programs.