Regarding unit testing best practices

I have been tasked with testing an existing application, and I've done so with my own in the past, but I am a little unsure of whether I am using the right approach.

Let's say I have the following example:

Class users has a function called getAll() which returns the list of users by querying the database. There are (as far as I can tell) two straightforward ways to test this functionality:

• 
  

  Use the same query code that the getAll() function uses, independently in the unit test. Then, perform the getAll() call and assert the results.

  
  


• 
  

  Have a data provider give the unit test data that is of the format that is expected, hard-coded to values we know are contained in the database. For example, we would pass a hard-coded array containing all users in the format the the getAll() function expects, and assert the results.

  
  

Although the second approach seems more in line with testing, it has the added results of adding a layer of security risk. Anyone with access to the test suite would also have plaintext access to a lot of potentially sensitive data. On top of that, depending on database size queries like the above could make the tests ridiculously long for very little reason.

Which would be the preferred approach?