Yes it does and it is pretty flexible.
See that KBA to stop to report on parameters for EJB, RMI and servlets for example:
Also by default, it does not expose SQL bind variables again for security reason but it can be enabled if required.
From the doc:
Unless this option is enabled, transaction trace data shows SQL statements with variable names but not values. For example, the following transaction trace shows the variable “studentname”, but it does not show the variable’s value:
If you enable this option, the trace data will include the variable name (or position in the SQL statement), and its corresponding value. These values appear in the Call Tree section of the Transaction Details window.
The following example shows the contents of the SQL Bind Variable column, with bind variables and values for the previous SQL example:
You don't need to resort to the JSON overrides described in that KB article. The 'Parameter Reporting' settings (added since that article, I think) in the Configuration screen directly control reporting of parameters for the 'Web Tier' (which includes Servlets), EJB, and RMI categories of classes: