When the user logs in the current session vairables are set

$_SESSION['user']['timeout'] = time();
$_SESSION['user']['ip'] = $_SERVER['REMOTE_ADDR'];
$_SESSION['user']['agent'] = $_SERVER['HTTP_USER_AGENT'];

In my common.php page (required on ALL php pages) i have used the below script, which resets a 15 minute timer each time the user is active furhtermore checks the IP address and checks the user_agent, if they do not match that as of when they first logged in/when the session was first set, the session is unset furthermore with inactivity of up to 15 minutes the session is also unset.

... is what i have done a good method for preventing session hijacking furthermore is it secure and or is it enough? If not what more can be done?

if(!empty($_SESSION['user'])){  
    if ($_SESSION['user']['timeout'] + 15 * 60 < time()) {
        unset($_SESSION['user']); 
        } else {
        $_SESSION['user']['timeout'] = time();
        if($_SESSION['user']['ip'] != $_SERVER['REMOTE_ADDR']){
            unset($_SESSION['user']); 
        }
        if($_SESSION['user']['agent'] != $_SERVER['HTTP_USER_AGENT']){
            unset($_SESSION['user']); 
        }
    }
}