I am assuming you are using the Execute SQL Task. You can map variables to the ? in the order they appear on the Parameter Mapping tab.

I see that you are not using the variables as true parameters, but more like dynamic SQL builders, so I would probably take a different approach. I would create a variable to build your entire SQL Statement, not just the dynamic portions of it, and then change the SQL Source type in the Execute SQL Task from Direct Input to Variable.