has listed some good advice (you should also make sure that you regex your input!!! someone could easily crack your script by passing it special chars) but to answer your specific question about not being able to run the command you may have a problem with permissions. CGI programs tend to run as
(if an admin sets things up that way). Check to see if your pgp program has permissions which are accessible to your CGI script. Also you may want to ensure that your echo command is fully qualified as
. As another measure to test your program, you may want to simply run the gpg command with a string of your own thus excluding the echo command to make things as simple as possible.