php - Is this Data Encryption/Storage Method Secure? -

let me first i know bad idea store sensitive information in mysql database, please don't respond saying "don't it" or effect. building website absolutely essential store social security numbers, , have able retrieve data out of db (no hashing).

that said, have researched best way encrypt/decrypt data, , built custom function handle encryption. here encrypting function:

function my_data_encrypt($value){     $salt=substr(uniqid('', true), 0, 20);     $key=$salt.my_private_key;     $enc_value=base64_encode(mcrypt_encrypt(mcrypt_rijndael_256, md5($key), $value, mcrypt_mode_cbc, md5(md5($key))));     return array("enc_value"=>$enc_value, "salt"=>$salt); } 

so generating random string salt, appending salt private key my_private_key defined in separate config file. use mcrypt_encrypt encrypt data, base64_encode make encryption safe store in db. encrypted string , unique salt returned , stored in db together.

my thinking throwing "private key" stored in config file (not db) mix add level of security encryption, way if hacks database , gets encrypted value , salt, still wouldn't have need decrypt data.

can security experts review function , let me know if/how data hacked , if there else improve it?

i have moved question https://security.stackexchange.com/questions/35690/is-this-data-encryption-storage-method-secure . feedback.

my 2 cents... random string isn't random because you're using time based function, instead consider openssl_random_pseudo_bytes

second, because didn't explicitly mention it, you'll want use ssl/ssh types of data transactions.

as far private key, config file located outside of publicly accessible directory , not in shared environment.