For sites that use HTTPS, the owner of the network (the school in your case) can see what domains you visit, e.g. facebook.com, but not what you do there - what pages you visit, what Friends you poke, what password you enter, etc. Facebook, Gmail, etc. use HTTPS.
For sites use HTTP instead of HTTPS, your school can see all of the above, including your password. They can also modify the content you see.
There is one caveat though. If your school has made you install a certificate on your phone or computer, or some other software for that matter, your HTTPS traffic is no longer safe.
Ordinary SMS messages are not sent over WiFi even if your phone is connected to one. Instead they are sent over the mobile network.