I asked this question on bitcoin forum too (just for the record): https://bitcointalk.org/index.php?topic=430972.new#new

I am trying to develop a php web application (a game, and not a gambling site) where users can make in-game purchases. Now if I am understanding it right, The architecture (using bitcoind and Json-rpc api) should be:

1. When a new user registers - generate a new address for the new user:

$bitcoin->getnewaddress("username");

2. Store that wallet address for later use in my DB.

3. Display that address and let a user send bitcoins to that address.

4. Check the balance of that address using the

$bitcoin->getbalance($username,0)

for unonfirmed balance and

getbalance($username,6)

confirmed balance.

4. Now I can let the user buy my in-game items and use

$bitcoin->move($useraddress, $myaddress, $amount)

to debit his account and give him the stuff he needs.

Questions:

1. Does this sound about right?  Or am I completely off here! 
2. How long does it take for the unconfirmed balance to show up?  [$bitcoin->getbalance($username,0)] 
3. $bitcoin->move($useraddress, $myaddress, $amount)  is a change of bitcoins between addresses within my wallet, so this should be
offchain and instantaneous, right? 
4.  How can some gambling dice sites like coinroll.it ( https://bitcointalk.org/index.php?topic=191176.0) accept unconfirmed
transactions and lets  people play instantly? are they just taking
the risk or there is something that I am not aware of. 
5. How can I test out my bitcoind/php application with testnet? Anyone has any experience of this?
6. Suggestions on Security are welcome...

I am going to make parts of my code open source when I figure this shit out

I asked this question on bitcoin forum too (just for the record): https://bitcointalk.org/index.php?topic=430972.new#new

I am trying to develop a php web application (a game, and not a gambling site) where users can make in-game purchases. Now if I am understanding it right, The architecture (using bitcoind and Json-rpc api) should be:

• When a new user registers - generate a new address for the new user:

  $bitcoin->getnewaddress("username");

  Store that wallet address for later use in my DB.

  Display that address and let a user send bitcoins to that address.

  Check the balance of that address using the

  $bitcoin->getbalance($username,0)

  for unonfirmed balance and

  getbalance($username,6)

  confirmed balance.

  Now I can let the user buy my in-game items and use

  $bitcoin->move($useraddress, $myaddress, $amount)

  to debit his account and give him the stuff he needs.

Questions:

1. Does this sound about right?  Or am I completely off here! 
2. How long does it take for the unconfirmed balance to show up?  [$bitcoin->getbalance($username,0)] 
3. $bitcoin->move($useraddress, $myaddress, $amount)  is a change of bitcoins between addresses within my wallet, so this should be
offchain and instantaneous, right? 
4.  How can some gambling dice sites like coinroll.it ( https://bitcointalk.org/index.php?topic=191176.0) accept unconfirmed
transactions and lets  people play instantly? are they just taking
the risk or there is something that I am not aware of. 
5. How can I test out my bitcoind/php application with testnet? Anyone has any experience of this?
6. Suggestions on Security are welcome...

I am going to make parts of my code open source when I figure this shit out