Yes you need to set the parameters for the Execute SQL Task and use select the variables as Input types. Not sure what type of query you are using but if you are trying to execute a procedure use something like

Exec my_sp ?,? (for OLDBD type connection)

And depending on your connection type you need to set the parameter marker, parameter name etc. The following link might be useful for this

http://www.sqljunkies.com/WebLog/knight_reign/archive/2005/10/05/17016.aspx