A full answer would be far beyond a post on this site, so I will only give hints here.
You problem a real security question. The answer will not be (only) technical, but you should first wonder about your real security requirements. In security, I want a safe solution just means nothing, a solution can only be safe according to a system of security requirements.
So you should ask yourself the following questions - I do not know your use case, so I cannot answer them
- what are the already known weaknesses (known vulnerabilities in used libraries or frameworks, pen testing reports...)
- what are the threats to consider (information theft, unwanted modifications, denial of service, physical attack...)
- what are the possible attackers you want to be protected against (script kiddies, NSA, russian mafia...)
- what could be the possible consequences of data compromission
You will end with a number of risks. You then will have to say how you can mitigate the risk itself or its consequences, and whether the remaining risk is acceptable or not.
What you propose is a mere obfuscation of data requiring first an attack of the web server and then access to the database. You can say whether it is acceptable for your security requirements after doing your risk analysis, I cannot.