I have a form on my site that collects some fairly sensitive data (personally identifying data). I have been reading on here how best to secure and am somewhat overwhelmed by the varying opinions. First, let me explain what I have done so far:

* My site is a joomla 3.x site, and for retrieving any form data it is done with a built in class that does some input validation (i.e. I am not just taking raw GET or POST data).
* My site does not have user registration. There is just a superuser account, and I am the only admin.
* I have a shared web host and can't really speak to their internal measures.
* I set up the form so that it is done via https.
* In PHP config I make sure magic quotes is on.
* When doing db queries, Joomla uses a built in class that escapes strings (so I think the site is at least somewhat resistant to SQL injection).
* For all form fields I limit the varchar length to reasonable values.

So far, the data is stored in the DB as plain text, and this is what I want to change. I read about MySQL's built in AES function and BLOBs, but I read on here that a lot of people recommend against it (though others think it is fine...). I know the ultimate approach is probably using keys externally stored elsewhere, but I am also trying to keep things as simple as possible, while being sufficiently secure. If I am taking other measures to safeguard (as mentioned above) will the MySQL functions give me a decent level of security?

Also, when a user submits the form, they receive an email with their data. I confirmed that the email seems somewhat secure in that the header shows

```
Received: from myhost (myhost. [IP])
    by mx.google.com with ESMTPS id
    br2si8908071ojb.205.2015.04.22.08.36.02
    for <someemail>
    (version=TLSv1.2 cipher=ECDHE-RSA-AES128-GCM-SHA256 bits=128/128);

```

Anyway, before I start implementing some sort of secure storage in the db, I was curious what you all recommend as a nice pragmatic approach.