if You're wanting to totally Block ALL Robots, from MY understanding of the file, Youshould only need these two lines.

user-agent: *
disallow: /

otherwise, Note the changes I made in Your htaccess file
post back, lemme know how things go for ya

If you are using a global header you may try using this meta tag as well:
<META NAME="ROBOTS" CONTENT="INDEX,NOFOLLOW">
But really you really only need to use that when you have files in a directory that you don't want to put in your robots.txt file, and want to have a tidy robots file.
not sure what using .htaccess gains you, unless you are willing to play around with rules based on user agents, which may end up blocking alot of traffic you don't really want to and also would take alot of work to keep up with all the different robot agents out there. Not trivial.
if your friend meant to do an .htaccess to password protect it that's a different matter and kind of a different issue, but what jusCk said in his post about the robots.txt should really be sufficient unless you're running into bots with bad etiquette.