If the PHP code is being executed by the webserver, it is running under the user "www-data" in ubuntu.
Probably www-data has no right to shutdown, which is a sane default.
You can give www-data sudo rights to shutdown without providing a password and call reboot using sudo.
Take a good look at man sudoers
and be sure to understand the security implications before editing the sudo config: this will effectively give any PHP script the right to shutdown the server (untested).
# /etc/sudoers (edit using the visudo command)
Cmnd_Alias SHUTDOWN = /usr/sbin/shutdown
Cmnd_Alias HALT = /usr/sbin/halt
Cmnd_Alias REBOOT = /usr/sbin/reboot
Host_Alias LOCALHOST = 127.0.0.1
www-data LOCALHOST = NOPASSWD: SHUTDOWN, HALT, REBOOT
In PHP you can use:
shell_exec("/usr/bin/sudo /usr/sbin/reboot");