Which database is more suitable for executing user submitted queries? I am in charge of creating a custom reporting tool for the company's clients. The goal is to let the client's in-house/contractor developers to query our database via a web-based query tool.

There are two main concerns here: Having users only read-only access to the database -- with no ability to run admin functions via queries, and having every query being async and have a timeout to prevent un/intentional DDoS attacks.

I can choose from PostgreSQL, MongoDB and MySQL, but I'm not expert in any of these. Therefore my question is which of these databases offers:

a) more control over each individual query 

b) more sophisticated user-based permissions and access control system

c) and a better built-in performance overload handling in case of many small queries or few huge queries that can potentially crash the database

I understand that I'm mixing NoSQL and RDBMS here, but I'm happy to go for either of these if I can build a more reliable solution in the end.

Also scaling and performance come as lower priorities and can be totally excluded from the comparison.
I can only comment on the (never ending) MySQL vs. Postgres question. I have never used MongoDB.




  more control over each individual query


Not sure what you mean with that. If that refers to limiting resource consumption then I don't think any of those three products will help you with that. 

If that is about the possibilities you have when writing queries, then Postgres is the clear choice for that. It has a lot more modern SQL features then MySQL does. My understanding is that MongoDB's aggregation capabilities are still not on the same level as those available in modern relational databases - but I have never used MongoDB so I can't tell.


  more sophisticated user-based permissions and access control system


Postgres has definitely the more sophisticated permission systems with user groups and row level security. 


  and a better built-in performance overload handling in case of many small queries or few huge queries that can potentially crash the database


To my knowledge, neither Postgres nor MySQL have any built-in features to limit resource consumption of individual queries like e.g. Oracle or SQL Server offer (apart from things like global statement timeouts). But as I don't really use MySQL any more there might be something I don't know about.