SQLite supports named parameters: https://sqlite.org/c3ref/bind_blob.html

I don't know if Go's SQLite support in turn supports named parameters, but if it does, then that would likely help considerably with readability.