I've done it by having an additional TAB for the Query Parameter, putting a friendly-name on the Cell for each parameter and then including that in the QUERY. Can't remember how I included it in the Query though, and I can't find any of the XLS files in our Code Repository but our query would definitely be an EXEC MySproc, with some parameters, (rather than just a SQL SELECT statement)
Its to run a Stored Procedure. So instead of doing, say, SELECT Col1, Col2, ... FROM MyTable WHERE SomeCol = 'XXX' you would instead put that code in a stored procedure (its a bit like a subroutine, or function) and then EXECUTE that Stored Procedure. Usually a Stored Procedure will have one/many parameters so for example for the above SELECT statement the equivalent Stored procedure would be something like:
CREATE PROCEDURE MyProc
@MyParam1 varchar(10)
AS
SET NOCOUNT ON
SELECT Col1, Col2, ...
FROM MyTable
WHERE SomeCol = @MyParam1
GO