Bitcoind JSON-RPC - PHP user handling I asked this question on bitcoin forum too (just for the record):
https://bitcointalk.org/index.php?topic=430972.new#new

I am trying to develop a php web application (a game, and not a gambling site) where users can make in-game purchases. Now if I am understanding it right, The architecture (using bitcoind and Json-rpc api) should be: 


When a new user registers - generate a new address for the new user: 


  $bitcoin->getnewaddress("username");


Store that wallet address for later use in my DB.

Display that address and let a user send bitcoins to that address. 

Check the balance of that address using the 


  $bitcoin->getbalance($username,0)


for unonfirmed balance  and 


  getbalance($username,6)


confirmed balance.    

Now I can let the user buy my in-game items
and use 


  $bitcoin->move($useraddress, $myaddress, $amount)


to debit his account and give him the stuff he needs.


Questions: 

1. Does this sound about right?  Or am I completely off here! 
2. How long does it take for the unconfirmed balance to show up?  [$bitcoin-&gt;getbalance($username,0)] 
3. $bitcoin-&gt;move($useraddress, $myaddress, $amount)  is a change of bitcoins between addresses within my wallet, so this should be
offchain and instantaneous, right? 
4.  How can some gambling dice sites like coinroll.it ( https://bitcointalk.org/index.php?topic=191176.0) accept unconfirmed
transactions and lets  people play instantly? are they just taking
the risk or there is something that I am not aware of. 
5. How can I test out my bitcoind/php application with testnet? Anyone has any experience of this?
6. Suggestions on Security are welcome...


I am going to make parts of my code open source when I figure this shit out
You are very correct, but:


I would use getaccountaddress instead of getnewaddress. If the user doesn't exist, which is the case for a new user, the wallet will create a new one anyway.
I always would use the user's name to recover from the wallet his address, there's no sense to store it again on a DB. ¿?


The time for a balance to be confirmed depends on the coin and its network.

$bitcoin->move($useraddress, $myaddress, $amount) Yes, it is instantaneous. There's no transaction broadcasted to the net. 

How can I test out my bitcoind/php application with testnet? Anyone has any experience of this? ---> Go to the wiki, U have to set a specific parameter on bicoin.conf