Whenever I see those sorts of limitation I assume there's probably some kind of poorly handled escape situation to exploit

Which, in turn, implies that some system handles the password as plaintext rather than via a password-appropriate digest.