It really depends on the setup of the shared server. If it's set up well, it's extremely unlikely, but it does depend on how far into the server a hacker can get.
Basically, they do something called privelage escalation. They execute some SQL injection query for example, which then has some affect on some PHP code you're running. They can then in turn use that to access something else, and so on, all the while getting higher and higher levels of access.
It's a pretty complex issue, and one that many other books have been written about, but the first step in protecting yourself is to guard against input from the user, as that's the number 1 cause for concern.
If you're really worried, try to avoid using shared servers, or use a dedicated virtual server on a shared server.
