Who is the web host out of interest? Sounds like an overparanoid host?  I've never heard of anyone disabling `ini_set()`, in fact, it's the first time I've ever heard of it - disabling `eval` and `system` is more common (but still not much). Disabling `ini_set()` is pointless since anything important is out of scope for a userland change and can only be set by php.ini (like `disable_functions`).

It must be something isolated - even Wordpress uses copious amounts of `ini_set()` (20 times in their codebase) and Wordpress accounts for 17% of all websites! So one can surmise it's not something that is disabled often, if at all. since supporting Wordpress is compulsory.

OT: Most virtual hosting now runs PHP as CGI or FCGI so php.ini is always available to the customer as a necessity. cPanel, Plesk and Virtalmin (covering about 90%+ of all hosting control panels) give customer access to a custom `php.ini`.

Lastly, `ini_set` is completely required, because if you wanted to make use of a native session handler like files, sqlite, memcache then you can only set these using `ini_set('session.save_handler', $name)` as `session_set_save_handler()` able to set userland save handlers.

If a function is disabled by `disable_functions`, PHP will already throw an `E_WARNING`.

So I'd remove the PHP ini checks below. I think they are wrong anyway because PHP's `ini_get()` returns string even for flags.