Custom command patterns and !

WinSCP version 5.5.5

I was using the commander GUI to create a custom command to grep for a password in files within multiple directories.
I used this:

And then I think I killed our entire server by searching for a password with an exclamation point in it.

Can anyone verify whether or not the middle exclamation point in "!?pass!word?!" would be read as an exclamation point, or would winscp expand it into a file name unless it was escaped, or something else? Should I surround the search phrase by single quotes instead of double?

Also, can anyone clarify if !& expands to just selected files, or will it expand to a selected directory, too?

Thanks.

Can anyone verify whether or not the middle exclamation point in "!?pass!word?!" would be read as an exclamation point, or would winscp expand it into a file name unless it was escaped, or something else? Should I surround the search phrase by single quotes instead of double?

The exclamation mark terminates the "prompt" pattern, so in !?pass!word?!, the !?pass! is replaced by the user input, word? is used literally and ! is replaced by the name of selected file. Quotes have no effect on the custom commands.

Also, can anyone clarify if !& expands to just selected files, or will it expand to a selected directory, too?

See Apply to directories option:
https://winscp.net/eng/docs/ui_customcommand