Php

my friend has just made a website which lets you view pages with URL like page=blah.php and stuff, iv tried to explain to him that it's bad becuase people could do page=/etc/passwd but he said he used a shadow file so is np

is there anyway this still could be exploited or is he right?

Even if he is using a shadow file, that only hides the password for the account - the account information would still be in /etc/passwd - WHY give away anything?

Have him look at PHP Security mistakes