title: Encryption at rest and/or AES_ENCRYPT
body: <p>I am trying to improve the security a a MySQL database that will contain sensitive data. I am struggling to get to grips with some terminology. Can somebody let me know if I have understood the situation correctly:</p>
  
  <p><strong>Encryption at rest</strong>  - it seems like I can enable this on a table level. All data in the table in encrypted using a key. If somebody got hold of a backup file or gained physical access to the server then the data would be protected. This assumes, of course, that the key is stored elsewhere.</p>
  
  <p><strong>AES_ENCRYPT</strong> - when inserting/updating data into my table I can use <code>AES_ENCRYPT('data', 'password')</code>. When querying the data via a SELECT I use <code>AES_DECRYPT</code></p>
  
  <ol>
  <li><p>Assuming I was just using <em>encryption at rest</em> then do I need to do anything different in my PHP code to query the data? Does my PHP code need to send the key to the database via my PDO request? Or can I use my normal code for querying the database and the decryption is handled automatically?</p></li>
  <li><p>Or have I misunderstood what encryption at rest does and I need to use <code>AES_ENCRYPT</code> instead/as well</p></li>
  </ol>