I'm posting this in Cheap Plugs because it's mainly a link to my own website, even though I'm asking for advice.

I've been working on a web page that explains why websites that limit passwords to really short lengths are probably storing everyone's passwords in plain text. Here it is:

https://defuse.ca/passwordrestrictions.htm

I'm looking for advice in a few areas.

First, mysql_real_escape_string is so easy to use, I really can't think of a reason why some websites won't allow certain characters in passwords (even when they aren't hashing). Do you think my argument about "lazy input sanitization" is valid, or is there some other reason I'm not thinking of. I know that banks probably have legacy systems that will only accept mainframe style passwords, but if a website is backed by MySQL (or similar), what other reason would they have to disallow the use of certain characters? For example, cnet.com says:

Please use only alphanumeric characters, underscores "_", and dashes "-"

Second, let me know if there is anything else you would like me to cover, and let me know of any areas that are confusing or could be expanded.

Third, any suggestions for the layout? I'm happy with the logo and navbar (good enough), but everything in the white box looks like shit to me, so suggestions are welcome.

I should probably explain why I'm writing this page in the first place.

The only thing that storing passwords in the clear does is give cyber-criminals (NOT hackers, cyber-criminals in organized cybercrime) monetary incentive to hack shit for profit. Most of these passwords are accessible with simple SQLi attacks. To me, this is just like credit card fraud -- it gives mindless 13 year olds a way to compromise the security of hundreds of thousands of people, no effort required. I haven't been here long enough to judge where this community is on the whitehat-blackhat scale, but no matter what color hat you wear, I think you can agree that mass insecurity is a bad thing, especially when it's so easily exploited for profit.

Thanks in advance for any ideas.