is it possible to use shell script to view the contents of config files if the safe_mode is ON

If so how can I protect my server against the shell scripts

I'm assuming you are talking about safe_mode in PHP and shell scripts as in CGI scripts on the server.

Yes, you are correct, CGI scripts can view any file on the server if world read permissions are given to those files.

I'm not aware of a way to protect your files from CGI... CGI is inherently insecure.

what's the best way to protect my customers files from viewing by others ?

suexec

actually suexec isn't enough.
in order, to protect such things you will need to do the following:
1) setup suexec
2) put ALL users in one group ('www' for example)
3) tell to users to chmod their scripts and configs to '701'

this will prevent users from seeing other users' config file.

Miha.