if the database "can't handle it" [...] that proves that they make poor choices.

Exactly, the database should never even have to handle the password in it's original form and hashing algorithms don't care about special characters.

This is like when I was in my twenties working at a crappy grocery store with a MoneyGram inside of it. I live in Washington state, and at the time, if your last name was less than five characters, you would have asterisk's in your license number. The MoneyGram system wanted people's license numbers but was unable to recognize a license with an asterisk. It happened pretty rarely, but it always happened to people whose last names were four characters or less long. Five letters in your last name and you were gold. To make the transactions happen, I would just do the whole license number minus the asterisk.

Anyway, Washington changed how it generates license numbers so its a moot point anyway but I don't think MoneyGram ever spent a dime to fix this since it only affected a small number of people in one US state.

Sometimes I wonder if I'm even fit for employment as a developer and then I see shit like this where I wonder who and what happened for this to even become an option?

Seems to be they're dropping the passwords in the database in plain text, but they're deathly afraid that someone will drop a '; in there or something and the insert will break.

Notwithstanding that storing passwords in plain text is a slapping with the 10 foot rubber chicken, but mysqli_real_escape_string() or any number of other similar solutions are indeed a thing that exists. A prepared statement would work, too.

One can hope 🤞