Hi,
perfect hint: http://www.php.net/manual/en/reserved.variables.server.php. It's the manual for all information concerning your visitor. Look at "REMOTE_ADDR" for the IP-address.
To lock an account you simply count how often the user tried to log in in with a wrong ID. Simply place a file into a temporary folder named with the IP-address and save the time and date of the login (or even better unix-time: time()). If the time gap is lower than say 15 minutes you simply put a flag "locked" to your database or whatever system you're using for your accounts.