Database encryption doesn't make a whole lot of sense to me. Proper row and column security, and using real database user authentication (not one single, pooled web server user) is real security. A db on its own box, in its own network zone, physically controller by the data owner.<p>What's the threat here?<p>SQL Injection? Encryption won't help. Use parameterized queries and least privilege.<p>Evil admin? They can just monitor the web server instead of the db.