Using %s or f-strings opens you up to SQL Injection.

The way to pass parameters I come across most often (see documentation for module sqlite3) is cursor.execute("SELECT * FROM People WHERE Name=?", (my_name, )).

However pandas.read_sql_query docs say that parameters are passed as via the params keyword argument, not as the 2nd positional arg.

You need to use the params keyword argument:

f = pd.read_sql_query('SELECT open FROM NYSEMSFT WHERE date = (?)', conn, params=(date,))

The read_sql docs say this params argument can be a list, tuple or dict (see docs).

To pass the values in the sql query, there are different syntaxes possible: ?, :1, :name, %s, %(name)s (see PEP249).
But not all of these possibilities are supported by all database drivers, which syntax is supported depends on the driver you are using (psycopg2 in your case I suppose).

In your second case, when using a dict, you are using 'named arguments', and according to the psycopg2 documentation, they support the %(name)s style (and so not the :name I suppose), see http://initd.org/psycopg/docs/usage.html#query-parameters.
So using that style should work:

df = psql.read_sql(('select "Timestamp","Value" from "MyTable" '
                     'where "Timestamp" BETWEEN %(dstart)s AND %(dfinish)s'),
                   db,params={"dstart":datetime(2014,6,24,16,0),"dfinish":datetime(2014,6,24,17,0)},
                   index_col=['Timestamp'])

Break this up into three parts to help isolate the problem and improve readability:

1. Build the SQL string
2. Set parameter values
3. Execute pandas.read_sql_query

Build SQL

First ensure ? placeholders are being set correctly. Use str.format with str.join and len to dynamically fill in ?s based on member_list length. Below examples assume 3 member_list elements.

Example

member_list = (1,2,3)
sql = """select member_id, yearmonth
         from queried_table
         where yearmonth between {0} and {0}
         and member_id in ({1})"""
sql = sql.format('?', ','.join('?' * len(member_list)))
print(sql)

Returns

select member_id, yearmonth
from queried_table
where yearmonth between ? and ?
and member_id in (?,?,?)

Set Parameter Values

Now ensure parameter values are organized into a flat tuple

Example

# generator to flatten values of irregular nested sequences,
# modified from answers http://stackoverflow.com/questions/952914/making-a-flat-list-out-of-list-of-lists-in-python
def flatten(l):
    for el in l:
        try:
            yield from flatten(el)
        except TypeError:
            yield el

params = tuple(flatten((201601, 201603, member_list)))
print(params)

Returns

(201601, 201603, 1, 2, 3)

Execute

Finally bring the sql and params values together in the read_sql_query call

query = pd.read_sql_query(sql, db2conn, params)

The first argument to read_sql_query should be a string or SQLAlchemy Selectable (source). In your solution, the string is spread across multiple lines, so you should use triple quote syntax to wrap a multiline string.

Here is what you can do, also if you need to create a bunch of such queries you should create a function to do this for you. As Teja Goud mentioned.

#Define a, Date, c, t (the tuple) and format the query string as following
query = """SELECT {}, {}, {} FROM table_d WHERE a IN {} AND Date >= '2021-07-25'""".format(a, Date, c, t)

data_raw_sql = pd.read_sql_query(query, conn)

You passed the arguments to .read_sql_query() in the wrong order. You used

rt = pd.read_sql_query(conn, query)

when it should be

rt = pd.read_sql_query(query, conn)

Use python3 f-strings:

def myfunc(start_date, end_date):
    sql_syn = f"SELECT col_id, col_a, col_b, date, FROM en_stat where date between {start_date} and {end_date}"
    sql_df = pd.read_sql(sql_syn, con=db_connection, chunksize=100)

With pyformat you can write it like this

Val = 'abc'
product = pd.read_sql_query(
    "SELECT * FROM StoringTF WHERE Product_Code = %(val)s",
    c, params={'val': Val}
)

Formating the string in python, as suggested in some answers, opens up a chance for an SQL injection or just errors caused by some special characters in the variable.