If you do not need instant account creation, and an approximate 1 min delay is acceptable, you can use the following idea.
There should be 2 directories writable by web app : www-tmp, www-job
Each time web app receives a create account request, it will create a file in directory web-tmp. Then move the file to web-job. The reason not to create the file directly in www-job is to prevent the cron job(see next step) from reading an incomplete file.
Create a cron job that has the required permission, run every minute. Every time it runs, it will process all files in www-job, creating the accounts, then delete the files. Keep checking and processing till www-job is empty. Use pid lock to prevent parallel run.
With the above flow, your web app does not need any additional permission.
Web app is order desk. Cron job is production line. www-job is the queuing area. Different departments, different permissions.
Database table can be used instead of file/directory for queuing.
PS: Your cron job, no matter bash, php or perl, should do the final check before passing the argument to a system call.
Username should contain only alpha(all lower or upper case if you want case insensitive usename) numeric, maybe with the addition of period(.).
For password, check for minimum length. Make sure (double check, triple test) script is passing it as one string to the system call, AND the system call is taking it in as one string.