: The attacker is attempting to determine the number of columns being returned by the original query. They add NULL values until the database stops returning an error, which reveals the table's structure.
If we were to view this string as a narrative, it tells the story of a . : The attacker is attempting to determine the
: Rejecting any input that contains SQL keywords like UNION , SELECT , or comments ( -- ). or comments ( -- ).