If you are on UNIX (not sure about other OS), then if you can make it work, the second method is more secure - other users that can list processes can see the username and password in the process listing if you specify

sqlplus system/manager@database

If you can't make it work, try

sqlplus system@database

This will allow other users to see the username in a process listing, but not the password. You will then be prompted for the password.

HTH

David.