Hmm. My understanding is that the kernel rather than the shell launches the program, not the interpreter, but the #! line then tells the kernel to launch the interpreter and pass the script to it. Whether a web server would call the kernel function directly or use bash to do so, I don't know. However, it would be very bad practice for a security-conscious application to pass anything derived from outside to the system directly as an environment variable, and I find it hard to believe that would be how it works. However, environment variables are created for the script to receive, and as I now understand it that is the problem, if the script is written in bash as the interpreter to be invoked, and the script therefore uses bash to process its instructions and data.
How many SSI or CGI scripts were written in bash I don't know. I've never done it, always preferring perl, which I found easier to understand (bash has a unique syntax I've always struggled to grasp, so I prefer C-like languages such as perl, javascript or php), but I suppose some might use bash.
