If your code could work, it would be serious breach of security. Good thing is that you CAN NOT inject and execute php code by your browser:) You can put php tags in html file, you can display it, but it will not even pass by the server, let alone execute it.
On the other hand you CAN create friendlist.php on the server and make sure:
.
Than you do your html/js in browser/client
_("right").innerHTML = ajax('http://yout_site.com/friendlist.php');
Btw, if you use JavaScript to request something from server and then display it in browser it's called ajax ;)
Just for fun, you could also use http://www.upiur_site.com/friendlist.php'> to avoid ajax. But that has many disadvantages.
For ajax function use library, write your own...
EDIT:
I missed third option if server is set to parse .js files. In that case will work.