In the PHP, error_reporting does not need to be detail necessarily for security purpose, and short_open_tag could cause coding error easily, but needs to be used for backward compatibility in some cases.

Below is what I am using for developing/operating PHP application in my servers:

error_reporting = E_ALL & ~E_NOTICE
display_errors = On
display_startup_errors = On
short_open_tag = On
register_argc_argv = On
include_path = ".:.."