Only for single data values. The intention is that the SQL be complete
enough that the DBMS can compile it and decide on the correct query plan
for repeated execution with whatever values are plugged in, like a stored
procedure with parameters. '?'s can't be used (though many try) to swap
in various parts of the actual SQL syntax, but this would define/alter the
query plan, so there would be no precompilation for reuse, so there would
be no advantage over simply constructing the SQL string at the client and
sending it fresh for every execution.
Joe Weinstein at BEA

The bind markers, ?, are only for data values. They can be used in a
where clause, in a select expression list, on the RHS of a set expression
and in a procedure or function call for input values. Also as a function
return value marker and OUT parameter markers in stored function or
procedure calls. You have to register OUT parameters including any return
value in a stored procedure or function call so these are markers for
output data or input and output data if a parameter is IN OUT.

Chuck