If the online game is on your site, then you'd still use localhost -- it'll just be a different localhost (the server rather than your own machine). If the game is hosted elsewhere, you'd probably be breaking the ToS/AUP using x10Hosting just for the database.
But to explain what I was saying: a web API is a service that you create. Instead of your users interacting directly with the database, they make a request to a PHP script, and that script talks to the database and returns the results, usually as some kind of structured text (XML or JavaScript Object Notation normally, but there are other less common structures as well) rather than as a web page. You can send the script something that looks an awful lot like a SQL query, but then your script pulls it apart and makes sure that everything it's asking for is something you allow. With raw access to the DB, you are allowing users to drop or alter tables and databases, read and write rows they shouldn't have access to, and so on. If they have to go through your script to get there, you can enforce permissions without creating a new DB user for every application user. (And user-based permissions in MySQL aren't very granular.)
SOAP is a web service protocol that rides on HTTP. If you were creating a .NET desktop application, it's the easiest way to talk to a remote computer -- you'd just include the web service using an include statement, almost as if you were using COM/OLE.
essellar, I am goin to say it, "what?"