You should be using the [QSA]
flag instead of trying to rewrite the query string. [QSA]
passes on the query string to the rewritten URL.
So your rule should look like:
...
RewriteEngine On
RewriteBase /
RewriteRule ^([A-Za-z0-9-_]+)/friends/? friends.php?user=$1 [QSA,L]
Your case is very similar to the example given for using the QSA flag in the mod_rewrite cookbook.