in reply to su to user in a cgi script
Think carefully about what you are trying to do. There are some commands that you need elevated privilege to run, however, either a setuid binary, or just changing appropriate access permissions are usually enough.
The problem is with most of these, I DO NOT consider them safe enough to run via a web interface. (plaintext password, remote access to system functions. Just say no kids.)
--
It's not pessimism if there is a worse option, it's not paranoia when they are and it's not cynicism when you're right.