You have to keep the data somewhere. Whether you end up using a database or not doesn't matter.
If you have to, you could just use text file to hold the banned IP's. Although, if you anticipate having a large number of banned IP's, you'll see a performance hit.
Also, you might think more about what banning IP's means. If an offending user is coming through a proxy server, the IP that you ban will be that of the proxy server (I think?). Thus, if you ban that IP, you'll be banning everyone that uses that proxy server.
Perhaps someone else has more knowledge about this sort of thing and can tell you if this is really the way it works.