Quite a few web apps (TWiki, YABB, etc) have been known to have a "settings.pl" file that they simply use on startup. This does exactly what you mention above. Very simple, and works very very well. Non-perl coders have no trouble keeping the syntax as long as non-pathological data structures (I love pathological data structures!) are used.

I suppose there is a security risk if permissions on settings.pl are not well known, obviously... but if you have a permissions problem on your web app, executing arbitrary local code is the least of many concerns.