Storing Sensitive Data with PHP and MySQL
<p>I am not incredibly familiar with cryptography, so please bear with me. I am working on an application that needs to store sensitive data in a database. This information; however, needs to be accessible to those with the proper credentials (so hashing is not going to work). </p>

<p>The data is gathered from a PHP form. My idea is to use prepared SQL queries and MySQL's AES_ENCRYPT function to store the keys in the database. Is this secure (if the key is kept safe - the point of my next post) or are there risks associated with this method?</p>

<p>Secondly, how would you recommend generating and storing the key? The problem is that the user who needs to access this sensitive data is not an IT specialist of any form - she simply is not familiar with the tools of the trade. If I only needed to access the data, this would probably not be too difficult, but how would I go about ensuring the security of the key, while allowing the user who is not experienced with databases, easily access it?</p>

<p>Thanks much.</p>