You are correct, it is the NLS_LANG parameter that caused my grief. I am working on a development/test server and my DBA recently deleted the directory that NLS_LANG pointed at, in order to prepare to load Oracle 9i. The CGI scripts apparently work OK since that web server was last started when the directory still existed.
A thousand thank yous.