$user and $pass work fine when I run the script from the command line and there is no way they could be changed during the CGI execution (they are, erm, hard coded...).
I went through mysql.user and the $user and $pass combination definitely are allowed on this database, from localhost and 127.0.0.1.
I hope you don't mind me asking if you could give me any pointers what to change in httpd.conf? Do I have to allow more in the ScriptAlias