What are the ways to list parameters in SQL?

There are several ways to list parameters in SQL queries that help prevent SQL injection and improve readability:

Positional parameters: Parameters are defined by a placeholder (often ? or $N) and are passed to the execution function in a specific order.
```
SELECT * FROM users WHERE id = ? AND status = ?;  
```
During execution: parameters are passed as an array or list in the same order as the question marks.
Named parameters: Parameters are defined by a prefix (often : or @) followed by the parameter name.
```
SELECT * FROM products WHERE category = :category_name AND price > :min_price;  
```
During execution: parameters are passed as a dictionary or map, where the key is the parameter name and the value is its value.
Composite parameters (some DBMS and ORM): Allow passing data structures or objects as a single parameter. This is less universal and depends on the specific implementation. For example, in PostgreSQL, JSON can be used.
```
SELECT * FROM orders WHERE details @> ?;  -- details is a JSONB type field  
```
During execution: a JSON string or object is passed, which the DBMS can parse.

The choice of method depends on the DBMS, driver/ORM used, and personal preferences. Positional and named parameters are the most common. Using parameterized queries is a standard practice for secure database operations.