I am working on the exact same issue, and have given it some thought but am equally stumped. If I can checkout a module from a shell script, why the #$%@ can't I do it from system()?!
My current line of thought is that it's probably a user permissions thing. If my apache runs as 'nobody', is it safe to assume that system calls from PHP run as 'nobody' too? Does 'nobody' need any permissions/ protocols set to use cvs? (I set my target folder as chmod 777 as a test, but still no dice.)
Incidentally, I've installed mod_cvs for apache (which is supposed to do this job), but can't get that to work either.
I've done CGI before, but I'm a relative cvs and PHP newbie, so please be gentle. Will watch this thread with interest, and let you know if I discover anything.