CakePHP provides Model::query() for you to have more control. I'd be inclined that you use prepared statements too, if you really want to let go of CakePHP's find methods.
$db = $this->getDataSource();
$db->fetchAll(
'SELECT * from users where username = ? AND password = ?',
array('jhon', '12345')
);
$db->fetchAll(
'SELECT * from users where username = :username AND password = :password',
array('username' => 'jhon','password' => '12345')
);
Here is a note:
query() does not honor $Model->cacheQueries as its functionality is
inherently disjoint from that of the calling model. To avoid caching
calls to query, supply a second argument of false, ie: query($query,
$cachequeries = false)