I always wonder what kind of magic those websites do with the string. Hashing has become so simple. When you hash you don't have to worry about special chars (encoding issues though). It's only when you have bad practices that you should worry about ;") in the password field.

I wonder how many sites have been taking down by SQL injection attacks inside of a password. That would take something of a perfect storm of bad design, which is why I'm pretty sure there are sites out there that are vulnerable.