PHP security without php.ini

If you can't apply recommended php.ini setting to your server, the alternative way to do is to add this lines in root .htaccess

# Security
php_flag  allow_url_fopen 0
php_flag  allow_url_include 0
php_flag  display_errors 0
php_flag  expose_php 0
php_flag  log_errors 1
php_flag  session.use_trans_sid 0
php_flag  short_open_tag 0
php_value error_log error_log.txt