I've had private entities accept symbols upon creation, but not upon usage. I assume they were cleaning my data to prevent injection ... without telling the user which characters were forbidden.

Since it's a government site, you might be able to point out security protocols they are breaking. Once they've realized that they aren't following their own rules, just wait 10 years for them to correct it! Easy! 😀