I've just recreated the code after various other attempts, so please excuse any obvious typos, but this is the content of Foo.php:
<html>
<head>
<title>Foo</title>
</head>
<body>
<?php
echo
"<OBJECT ID='FooControl1'",
"CLASSID='CLSID:E2D0F8FD-FDEE-4018-8686-C5D5BB5F47D4'",
"CODEBASE='Foo.CAB#version=1,0,0,0'>",
"<PARAM NAME='FooStatus' VALUE='", $FooStatus, "'>",
"</OBJECT>"
;
?>
</body>
</html>
By the way, we know something of the dangers of ActiveX. This is a proof of concept project that might eventually run on locked-down machines. We envisage that they will be unable to do pretty much nothing else.
Thanks