When I first started using a password manager I found letting it generate long, strong passwords threw up some really weird behaviour on some badly-written sites.
A few times I'd generate a password and then not be able to login, then it dawned on me when a site did something slightly different that revealed what was probably happening.
I'd entered a long, strong password, and on submission it told me that my 3 character password was too short. Looking at the 4th character, unsurprisingly, this was a 'special' character. I'm guessing what was happening here was someone had used a regex or character replacement to sanitise the password, to prevent some form of sql-injection attack, and the rest of the string after that was just getting dumped.
The poor handling of the password string is basic shoddy coding, but it suggests a more fundamental problem - they're relying on half-arsed sanitisation of the strings rather than just using prepared statements which is a de-facto way of telling a database 'this is text, treat it as such and don't attempt to execute it'.
