: Combines the results of the original query with a new, malicious query.
: Fills columns with NULL values to match the column count of the original query, which is required for UNION to work. The attacker keeps adding NULL s until the error disappears (often 500 internal server error) and a '200 OK' response is received. : Combines the results of the original query
(or sometimes -- ): A comment marker that hides the rest of the original SQL query, preventing syntax errors. preventing syntax errors.