Assuming you mean "read the source code" and not "modify the source code" when you say "source code access", then Kerckhoffs's principle applies and you're indeed correct that raw database access is a bigger threat. That's not to say you should make it easy for anyone to get your source code, but ideally your system should be designed so that you're not inherently vulnerable if your source code is leaked.
I can't imagine a way in which attackers could have access to the raw database records and still be secure. Your users will need a system to convert those records into something useful, and if it's a key then you're depending on somehow giving users the key in a secure way that attackers could never compromise. You'd need to either use something like Shamir's Secret Sharing algorithm to give each user a unique key, or change the key (and reencrypt your database) with a high frequency so that ex-users won't be able to access the data. This assumes that your attackers will never be users and never be able to compromise user's systems and never be able to find your key on your server. If you mean that attackers can insert or update database records when you say "the attacker has access to the raw database records" then there's nothing you can do to prevent your system from getting completely taken over. The whole thing screams "bad idea".
Generally, users access databases through a web page or program, and it's only that web server or software that has database access. The web page or program handles authentication and restricts what users can do to prevent attacks. The web page or program should be written so that it won't access the records for your users until it has authenticated them against credentials stored on your backend server; this prevents attackers from getting your data much more effectively than giving your database away and trying to find an encryption algorithm that will be fast for users and resist bruteforcing by attackers, and a method of implementation that will sufficiently protect your decryption key.
All that being said, AES would be an acceptable algorithm if you really, really wanted to do it that way in spite of all the reasons it would be a bad idea.