Restrictions on input characters are often as strong indication that a cryptographic key derivation function (or even just a salted cryptographic hash function) isn't being used to store the passwords.
It had simply been some time since I had worked with MySQL.
I didn't fully understand prepared statments when I began creating the site (as I had never worked with them before), so I put in a check to make sure that nobody was trying to inject anything via SQL when registering, but I realize that is all for nothing now when using prepared statements.
Needless to say, I have removed the password restrictions... now the only restriction is that it must be at least 6 characters in length, and must be no more than 5,000 characters in length. You should be able to use any kind of crazy UTF8 combination of characters you can muster.
Not only that, but attackers are limited to 3 attempts per IP per hour when trying to log in via brute force.
fixed