Can't figure out what this error is trying to tell me

Question

I've looked everywhere and I can't find anything helpful. I'm trying to create an online sheep game, and to begin playing the game, the user needs to select the color and name of their first sheep. When submitted, it inserts the data into my MySQL database successfully, but displays this error:

Error: 1 You have an error in your SQL syntax; check the manual that corresponds to your MariaDB server version for the right syntax to use near '1' at line 1

Here's my syntax to connect to the database:

    <?php
    $conn = mysqli_connect("localhost","root","","flyingfeetranch");
    // Check connection
    if (mysqli_connect_errno())
      {
      echo "Failed to connect to MySQL: " . mysqli_connect_error();
      }
    ?>

Here's my form and what I use to insert:

    <form name="properties" method="POST">
<input type="radio" name="color" value="white" selected="selected">White<br>

Name: <input type="text" name="name" value=" "/>
<input type="submit" name="submitname" value="Submit"/>
</form>
</div>
<?php


    if(isset($_POST['submitname']))
    {
    $Color = $_POST['color'];
    $Name = $_POST['name'];
    $Age = "12";


        $sql = mysqli_query($conn, "INSERT INTO babydolls (name, color, age)VALUES ('$Name', '$Color', '$Age')");
        if($conn->query($sql) === TRUE) 
        {
            echo "New record created successfully";
        } 
        else 
        {
            echo "Error: " . $sql . "<br>" . $conn->error;
        }
    }

?>

@Mike For those who know ;-) but the OP may be new to all this and may not know how to interpret errors. However, this isn't really an "error" per se, it's a weird warning that gets thrown by doing something twice. — Funk Forty Niner, Feb 15 '18 at 20:12
[Little Bobby](http://bobby-tables.com/) says ***[your script is at risk for SQL Injection Attacks.](http://stackoverflow.com/questions/60174/how-can-i-prevent-sql-injection-in-php)***. Even [escaping the string](http://stackoverflow.com/questions/5741187/sql-injection-that-gets-around-mysql-real-escape-string) is not safe! — Jay Blanchard, Feb 15 '18 at 20:22

Funk Forty Niner · Accepted Answer · 2018-02-15T20:20:16.910

The "1" stems from querying twice, which means it worked. Had it been a "0", then that'd of been a different ballgame.

Remove one of the querying functions.

Just check with the variable for it.

$sql = mysqli_query($conn, "INSERT INTO babydolls (name, color, age)VALUES ('$Name', '$Color', '$Age')");
        if($sql) 
        {
            echo "New record created successfully";
        }

Beware, you're open to an sql injection here, use a prepared statement.

https://en.wikipedia.org/wiki/Prepared_statement

Note: You should also check for empty fields and checking if a radio is set should you happen to remove the "selected" from it (bit of a side note here). That could cause you problems if none of those fields are not filled and your db doesn't accept empty/null values.

References:

Can't figure out what this error is trying to tell me

1 Answers1