That looks ok to me...

[oracle@host122 ~]$ cat test.sh
echo "exit" | sqlplus / as sysdba @test.sql
[oracle@host122 ~]$ cat test.sql
select 'RUNNING_TEST' from dual;

[oracle@host122 ~]$ ./test.sh

SQL*Plus: Release 12.2.0.1.0 Production on Sat Oct 22 09:37:50 2016

Copyright (c) 1982, 2016, Oracle.  All rights reserved.


Connected to:
Oracle Database 12c Enterprise Edition Release 12.2.0.1.0 - 64bit Production

/bin/bash: title: command not found


'RUNNING_TES
------------
RUNNING_TEST

sys@db122
SQL> Disconnected from Oracle Database 12c Enterprise Edition Release 12.2.0.1.0 - 64bit Production

And works if the username is wrong as well

[oracle@host122 ~]$ ./test.sh

SQL*Plus: Release 12.2.0.1.0 Production on Sat Oct 22 09:38:48 2016

Copyright (c) 1982, 2016, Oracle.  All rights reserved.

ERROR:
ORA-01017: invalid username/password; logon denied


Enter user-name: Enter password: 
ERROR:
ORA-01005: null password given; logon denied


Enter user-name: [oracle@host122 ~]$ 

One thing I normally do is put the connection string in the script itself rather than on the command line. (Some versions of SQL PLus will leave that visible from things like a 'ps' listing). So I do:

print "
connect u/p
@longsql
exit" | sqlplus /nolog