Curl command for adding commands is not submitting the entire message

[DungeonParlour]

I am attempting to get a 250+ character command on my YouTube Nightbot account, and I got as far as using a custom Nightbot API to submit the command via a curl command, however when I send the command I am unable to send an ampersand (’&’) through it.

Here is a sample of what I mean:

.BAT File: (Removed any unimportant code and any security tokens of course)

curl -X POST "https://api.nightbot.tv/1/commands"
-H "Authorization: Bearer 1234567890qwertyuiop"
-d "message=$(eval if(...){const req = `$(urlfetch https://website.com/command?value1=YouTube~~$(userlevel)~~$(userid)&value2=$(user)&value3=$(querystring))`; `@$(user): Your Level Code "$(querystring)" has been submitted!`;}else{`@$(user): Error`;})"
-d "userLevel=everyone"
-d "coolDown=5"
-d "name=!test"

Response:

{
    "command":
    {
        "_id":"1234567890",
        "createdAt":"2021-07-29T07:32:35.000Z",
        "updatedAt":"2021-07-29T07:32:35.185Z",
        "name":"!test",
        "message":"$(eval if( . . . command?value1=YouTube~~$(userlevel)~~$(userid)",
        "userLevel":"everyone",
        "count":0,
        "coolDown":5
    }
    ,"status":200
}

For some reason the ampersand (’&’) just cuts the message short.

I have tried replacing the ‘&’ with the following:
"^&" - Thought this was command line related, not at all the case. Results in the same thing, but ends the message with “^” instead
"%26" - Thought it needed to be encoded, but this did not encode properly. The message had the full text this time, but where an “&” would have been, there was a “6” instead, essentially ignoring the “%2” (probably a command line related reason).

I am out of ideas for what to do, so I was hoping someone here knew what was going on and how to fix it / wok around it, or if there is a better solution than what I am attempting to do. Thank you in advance!

[Aaron128l]

My guess is your payload is getting messed up by not escaping your strings.

Your message has "$(querystring)" which stops the message to

"message=$(eval if(...){const req = `$(urlfetch https://website.com/command?value1=YouTube~~$(userlevel)~~$(userid)&value2=$(user)&value3=$(querystring))`; `@$(user): Your Level Code "

which is likely unintended.

As

curl --location --request POST 'https://api.nightbot.tv/1/commands' \
--header 'Authorization: Bearer token' \
--header 'Content-Type: application/x-www-form-urlencoded' \
--data-urlencode 'coolDown=5' \
--data-urlencode 'name=!ampcommand' \
--data-urlencode 'message=This & that & this &&&' \
--data-urlencode 'userLevel=everyone'

works fine