By default, reboot command must be executed as root. You would be able to do that if your web server ran under root account, but this is very unusual proposition.
Typically, web server runs under limited account which cannot do much, and certainly cannot execute reboot. If you really want to do that, it must be done with great care. Standard way to provide this is to create special wrapper (most likely suid) which checks for many conditions before allowing to run under elevated permissions.
Another solution is to have PHP create flag file or insert special database entry, which would be checked by another service running as root, noticing that flag and finally executing reboot.