How do I prompt input for database on command line?

Ampersand (&) is used for SQL*Plus substitution variables. You are supplying it on the Windows command line, where it means something else; when you exit from the client you'll see something like:

'username' is not recognized as an internal or external command,
operable program or batch file.
'password@' is not recognized as an internal or external command,
operable program or batch file.
'dbname' is not recognized as an internal or external command,
operable program or batch file.

The batch file will treat it as a command separator, so it passes nothing to SQL*Plus, and only looks at what's after it once that program has completed.

The username/password prompts are completely indpendent of your command line values. It will be connecting locally to whatever your ORACLE_SID environment variable is set to, or if your TWO_TASK environment variable is set then it will be using that as a TNS connection.

You can prompt for the three pieces of information in a SQL script as you attempted in your previous question, or prompt for them from the batch file and pass them on the command line, in a loop if you want to handle mistakes as Mofi showed; but as I mentioned in a comment on that answer, putting the credentials on the command line isn't very secure. You could use a 'heredoc' to use the batch variables directly in a code snippet, rather than using a SQL script.

For example, just to mimic what you were doing before, you could replace Mofi's sqlplus.exe line with:

@(
echo whenever sqlerror exit failure
echo connect %SqlUserName%/%SqlPassword%@%SqlDatabase%
echo select * from dual;
echo exit 
) | sqlplus.exe -s /nolog

Or to run commands from a script file:

@(
echo whenever sqlerror exit failure
echo connect %SqlUserName%/%SqlPassword%@%SqlDatabase%
echo @myscript.sql
echo exit 
) | sqlplus.exe -s /nolog

Note that since you are doing the connect with your supplied credentials before calling the script, the script itself should not have a connect statement, and it won't be be able to see you Windows % variables. (It's possible to make them visible but I don't think you need to). Also note that the whenever statement means it won't attempt to execute the script if the connect fails.

You can run as many scripts as you want with more echo statements, and/or other statements not in scripts. But if any script includes an exit, or causes an error that exits, that will terminate the whole session and not just that script.

As any error in your SQL will cause an exit, not just a credential problem, you'll loop around when you don't want to, as you noted in a comment. You have a couple of options:

• You could add whenever sqlerror continue after the connect statement; but then if you hit an error it will continue and try to run subsequent commands anyway, and depending on what you're doing that might end up with strange results. But if you're creating objects then you might have protective drops that you don't mind throwing errors you want to ignore.
• You could use whenever sqlerror exit 2 before the connect and whenever sqlerror exit 1 after it. Then your batch script can decide whether to loop to prompt again based on the return value, 1 or 2. (I'm not really familiar with Windows exit codes so other values might be more appropriate to avoid confusion).

Or you could mix both to have the failure of specific commands handled differently, so you ignore an error on a drop say, but anything else exits the script. Depends what you're doing and what your detailed requirements.

Read more about the whenever behaviour.