Difference between Database.query() and database.getQueryLocator()

database.query allows you to make a dynamic SOQL query at runtime. You can build up a string and then use that as a query string at run time in the database.query statement to make a SOQL call that is determined at run time.

String fieldName = 'Name,Phone';
String dynQuery = 'select Id ' + fieldName + ' From Account';
Database.query(dynQuery);

database.getQueryLocator returns a Query Locator that runs your selected SOQL query returning 
list that can be iterated over in bathc apex or used for displaying 
large sets in VF (allowing things such as pagination). 

The query locator can return upto 50 million records and should be used in 
instances where you want to bactha a high volume of data up (pagination 
or batch apex). The database.query method should be used in instances 
where you are wanting to do a dynamic runtime SOQL query for your code.