$is_blocked = $dbh->prepare('
SELECT 1 FROM blocks WHERE
( ? & mask ) == ( ip & mask )
');

deny_access if ($is_blocked->execute(ip2int('192.168.254.1')));

# blocks
#  ip integer,
#  mask integer
1.0.0.0  == 16777216
1.1.0.0  == 16842752
1.1.1.1  == 16843009
255.255.0.0 == 4294901760

16777216 & 4294901760 == 16777216
16842752 & 4294901760 == 16842752
16843009 & 4294901760 == 16842752

so... blocks
ip          mask
16842752    4294901760   (1.1.0.0 255.255.0.0)

will block everything under 1.1.0.0/16