Preventing session hijacking
Checking an "constant" IP address is an bad idea because of ISP with load balancing. IP address should change to less busy proxy. 

In most of cases IP address belongs to the same block. It is called CIDR matching:

function cidr_match($ip, $range)
{
    list ($subnet, $bits) = explode('/', $range);
    $ip = ip2long($ip);
    $subnet = ip2long($subnet);
    $mask = -1 &lt;&lt; (32 - $bits);
    $subnet &amp;= $mask; # nb: in case the supplied subnet wasn't correctly aligned
    return ($ip &amp; $mask) == $subnet;
}


usage:

if(!empty($_SESSION['ip'])){
  //192.168.001.xxx = 192.168.001.000/24
  if(!cidr_match($_SERVER['REMOTE_ADDR'],$_SESSION['ip'].'/24')){
     session_destroy();
  }
} else {
  $_SESSION['ip'] = $_SERVER['REMOTE_ADDR'];
}


http://en.wikipedia.org/wiki/Classless_Inter-Domain_Routing

Personally, i recommend to you to check IP address range and some client data (but data may be fake).

PS: do not store session data in MySQL, you should store them just in session.