You should confirm this by printing the $< and $> values from your CGI script. One is the "real" user id (in numerical form), one is the "effective" user id. I'm expecting that neither one is set to the ID you expect.