adding values into an array using a while loop

You can't echo an array. You can use either print_r($friends) to display the whole row of fields requested in the query (you request *) or you can echo $friends['name'] (depending on how you declared name in your database)

You have syntax error:

$FREINDS = array(); should be $FRIENDS = array(); .

And also:

$FRIENDS = $REQUEST_ROW['USERNAME'] should be $FRIENDS[] = $REQUEST_ROW['USERNAME']

And

echo $FRIENDS; should be echo json_encode( $FRIENDS );

The PHP won't actually echo out an array. If you do an echo of an array, it outputs "Array". Plus your javascript wouldn't know what to do with a PHP array if it did pass it that way.

Try:

echo(json_encode($FRIENDS));

Also, you should really listen to the feedback in the comments. Your code is very vulnerable to attack and not set up to scale well for such a potentially huge app.

You have a couple of issues that make your code either less secure or less efficient. The most obvious inefficiency is that you are doing a database call inside your while loop, so if someone has 10 friends, that means you've done 11 database queries when you may have only needed one or two. Here are the two queries:

SELECT * FROM `FRIENDS` 
WHERE `USER` = '{$Modules['User']->Username}' 
AND `STATUS` = 'accepted' ORDER BY `ID` Limit 10

SELECT * FROM `USERS` WHERE `USERNAME` = '{$FRIENDS_ROW['FRIEND']}'

So before we determine if these two can be combined, the first big red flag is the SELECT *. I use it all of the time, but it will get you kicked out of the better database bars. In your case, it's really unnecessary. We know from the second query that the only thing you are using from the first query is the $FRIENDS_ROW['FRIEND'] to match against the USERNAME. So that first query can become:

SELECT FRIEND FROM `FRIENDS` 
WHERE `USER` = '{$Modules['User']->Username}' 
AND `STATUS` = 'accepted' ORDER BY `ID` Limit 10

You also have the SELECT * in the second query, and we can tell that (for now) the the only thing you are using is the USERNAME, so it can become:

SELECT USERNAME FROM `USERS` WHERE `USERNAME` = '{$FRIENDS_ROW['FRIEND']}'

Finally, we can see from the second query that the FRIEND name and the USERNAME are identical; otherwise why would you query for the usernames where the username equals the friend name. If that's the case, we can drop your second query completely, since we already know the usernames from the first query.

The reason why it's both inefficient and unsafe is because you are using the OG mysql functions, which are clunky and don't offer the option of prepared statements. Prepared statements let you (among other things) put variables in your query in such a way that when you actually call the query, the parts that are variables are known and can thus be sanitized, avoiding the horrors of mysql injections that everyone has mentioned.

I won't bore you with the play-by-play, but here is what your code might look like if you used the newer mysqli library with a prepared statement:

if($_REQUEST['D'] == 'viewfriends') {

    $friends = array();

    $friend_lookup = $mysqli->prepare("SELECT FRIEND FROM FRIENDS WHERE 
                                               USER = ? AND STATUS = 'accepted' 
                                               ORDER BY FRIEND");

    $friend_lookup -> bind_param('s', $userName);
    $userName = $Modules['User']->Username;

    $friend_lookup -> execute();
    $friend_lookup -> bind_result($friend);

    while($friend_lookup -> fetch()) {
        $friends[] = $friend;
    }

    if($friends) {
        echo json_encode($friends);
    } else {
        echo "Sorry, no friends. Boo.";
    }
}