Preventing SQL injection without using prepared statements
never return from constructor
avoid having new statements in the constructor
on error, throw an exception instead of echo + exit
% is used in MySQL's LIKE syntax 
you should refactor your DatabaseConnection::query() method - it's too high cyclomatic complexity 
constants are global immutable state (it's not as bad as mutable globals, but still a bad idea)
you should be using spl_autoload_register instead of the archaic __autoload
you are mixing HTML with logic .. bad idea, try this approach instead
don't use ".class.php" in filenames, because then you will be screwed, when you start adding interfaces (which one would want to autoload too)