title: Is a salted password and mySQL AES_ENCRYPT sufficient for storing sensitive information?
body: <p>I am using Apache, MySQL and PHP via HTTPS.</p>
  
  <p>I need to be able to store sensitive information so it can be shared among several people.
  If I have a database (secret) and two php files: (/var/www is my web root)</p>
  
  <pre><code>/var/inc.php
  /var/www/secret.php      
  </code></pre>
  
  <p>In /var/inc.php, among other things, I have a variable named $enckey, which is a 32 character alphanumeric string.  Its permissions are set to be read only.</p>
  
  <p>In secret.php I have a username, password and key field.  They key field ($key) is a string know by all users (each person has the same key since I'm using that as part of the salt), it would be a 8-12 alphanumeric with special characters string.</p>
  
  <p>Everyone has their own username and password that are MySQL users/passwords as well.  When they log in their user credentials would be validated with MySQL first.  There are no database usernames or passwords in /var/inc.php.</p>
  
  <p>My secret database has a table, <code>secret</code> like this:</p>
  
  <pre><code>CREATE TABLE `secret` (
      `id` int(11) unsigned NOT NULL AUTO_INCREMENT,
      `name` varchar(64) DEFAULT NULL,
      `data` text,
      PRIMARY KEY (`id`)
  ) ENGINE=InnoDB DEFAULT CHARSET=latin1;
  </code></pre>
  
  <p>If I store information in a MySQL table using:</p>
  
  <pre><code>AES_ENCRYPT('secret data', $enckey . $key)
  </code></pre>
  
  <p>and extract the data out using </p>
  
  <pre><code>AES_DECRYPT(`secret`.`data`, $enckey . $key)
  </code></pre>
  
  <p>am I doing enough to keep the data stored in the MySQL <code>data</code> column safe?  Is there something more/different I should be doing?</p>
  
  <p><strong>UPDATE</strong>:
  Any one given access to the site (anyone with a valid user name/password) would have access to all sensitive data.  The goal is to prevent a third party from getting the data if they were able to get to the database somehow.</p>