How secure this PHP encryption/decryption will be? - security

Question

I am working in a project where users will need to encrypt/decrypt data. The encrypted data will be saved in a MySQL Database. The users do login from a a login page login.php and the function Login() is called. Data is encrypted and Peppers are added at the end. Why? In case someone hacks the MySQL Database, the data is garbage for them because they also will need to have the Peppers to encrypt/decrypt data. The function ValidateLogin is not posted here but, the function is going to receive clear-text email and the encrypted password to validate if records exist in MySQL login table. Please answer me these questions:
What is the best cipher to use? (I have no clue about this but, I am
using AES-256-CBC
Do you think my script is good/secure enough to protect data?
File: peppers.php
<?php
define('PEPPER_PASSPHRASE', 'JkKli7YHUim6KH7tgyU6h56rykguhnBRvh23456%$%$#4c35$^$^Nm5GrBYB');
define('PEPPER_KEY', '6I7j5ih6tYHgbG4#$g%&h^&35$^g%7$VC$s23X#$%c^v$c35V^&b%&N6M8j^%4C54^#C5');
define('PEPPER_IV', '$^g%7&%b*45#$#4TF34TC3FG67H6755741532557B6$^v%$7$^^#$#%f&&B5B7V^*$6787');
?>
File: functions.php
function Login(){
$email = htmlentities($_POST["email"], ENT_QUOTES, "UTF-8");
$password = htmlentities($_POST["password"], ENT_QUOTES, "UTF-8");
if($email == NULL){ exit("Email can't be empty"); }
if($password == NULL){ exit("Password can't be empty"); }
#session_start();
$_SESSION["passphrase"] = hash("SHA256", $password.PEPPER_PASSPHRASE);
$password_encrypted = EncryptData($password);
$password = NULL;
ValidateLogin($email, $password_encrypted);
}
function EncryptData($data){
#session_start();
#$passphrase = $_SESSION["passphrase"];
if($data == NULL){ exit("Missing data to encrypt"); }
if($passphrase == NULL){ exit("Passphrase is not set"); }
$key = hash("SHA256", $passphrase.PEPPER_KEY);
$iv = substr(hash("SHA256", $passphrase.PEPPER_IV), 0, 16);
$output = openssl_encrypt($data, "AES-256-CBC", $key, 0, $iv);
return $output;
}
function DecryptData($data){
#session_start();
#$passphrase = $_SESSION["passphrase"];
if($data == NULL){ exit("Missing data to encrypt"); }
if($passphrase == NULL){ exit("Passphrase is not set"); }
$key = hash("SHA256", $passphrase.PEPPER_KEY);
$iv = substr(hash("SHA256", $passphrase.PEPPER_IV), 0, 16);
$output = openssl_decrypt($data, "AES-256-CBC", $key, 0, $iv);
return $output;
}