There are a couple of issues here.
First, MAC addresses, while intended to be unique, are in practice not. They are user-controllable.
The second issue is that your PHP-based application, if on the internet, will not be able to access the MAC address. The reason is that MAC addresses are layer 2 and layer 2 data is not typically sent across WAN links. If you want something to block, you have layer 7 data. This includes:
- User agent
- IP address
- URL requested
However, if your application is on the internet, it is going to get attacked. The energy should be spent on ensuring the application follows good development practices. This includes keeping it updated with any frameworks and libraries it uses, output encoding user-supplied data, parameterized queries, and so on.