That script might be made to work (but the manual page does not hint that it would accept the user and password in that manner).
What works for me is to factor out the user/password like this:
lftp -u user,password -e "command"
But I am using that with a private key, by setting options at the beginning of the command to use a given mykeyfile (which one could use in a script):
set ftp:ssl-allow yes
set ssl:key-file mykeyfile
set ftp:ssl-force true;
since private keys are generally preferable. For that case,
lftp ignores the given password on the command (but it must be given, to appease its command-parser).