You have to configure your webserver to execute your script. Typically, there's a cgi-bin directory, which is already configured to execute the CGI scripts which are in it (e.g. with ScriptAlias or ExecCGI in case you're using Apache — in this case, also see the tutorial Dynamic Content with CGI).  OTOH, this can also be configured by extension (e.g., .cgi, .pl), etc.

Also note that (with Apache on *nix) the CGI script additionally needs to be executable (i.e. have the 'x' bit set for user/group/other (whichever applies) — in case of doubt, try chmod a+x card.cgi).