ActiveRecord’s find_by_sql class method takes SQL as an input to return an array of ActiveRecord objects based on the results.  Only use this method when you really need it, because it does not take advantage of the abstractions provided to you to stay database agnostic.  In other words, City.find(:all) is nicer than City.find_by_sql( “select * from cities” ).  City.find(:all, :conditions => ["name like ?", "#{param}%"]) is better than City.find_by_sql( “select * from cities where code like #{param}”).

Rails will sanitize SQL, as long as you parameterize your query (use ? tokens).  This prevents your application from being exposed to SQL injection hacks.  Your SQL will be executed with the connection.select_all method, and ActiveRecord’s initialize method will be used on each of the results.