Seems likely, then, that the web user has no shell. Standard practice, for example with Apache on 'Nix, is to give the web-server user (id==www || id==nobody, etc.) /sbin/nologin as the shell ... therefore, the web user can't do any shell activity...
Are we in UNIX/Linux? Try:
$ more /etc/passwd | grep www
(or, try grepping "nobody" or "httpd"...) If the web user has no shell listed, there's the rub...
I recently put up a discussion regarding this in the Echo Lounge; although, I must say, thus far, it hasn't garnered much attention 🙂