As identified in this (https://www.zen-cart.com/showthread....69#post1344869) EMP posting, since the password fields in the admin are sanitized, changing a customer's password to a value that includes an HTML special character, e.g. &<>"', will result in the customer not being able to log in with that password.

Create a test customer on the storefront. Log into the admin, navigate to Customers->Customers to select that customer. Click the associated 'reset pwd' button and change the customer's password to test&value.

Now, go to the storefront (with that customer logged out) and attempt to login with the test&value password ... it's rejected!