Oracle Database Discussions

I want to execute following statement
C:\>sqlplus /nolog
SQL> conn scott/tiger
SQL> select * from tab;

I know I can realize it as following test.bat and testdb.sql file
test.bat is follows:
sqlplus /nolog @testdb.sql

testdb.sql is follows:
conn scott/tiger
select * from tab;

Now I don't want to use sql file,I only want to use bat file,like follows:
test.bat is follows:
sqlplus /nolog
conn scott/tiger
select * from tab;

when I run test.bat,I find only sqlplus /nolog statement execute,the other statements don't execute.
1)I want to know whether there is a method to execute sql statement only by bat file without a sql file? How to realize it?
2)If I call sql file,how to hide passord of user? Because I don't want to other persons know scott password,if I use conn scott/tiger in testdb.sql,other person can see testdb.sql and know the password. Is there a good method to avoid?

Thanks!