If the page loads normally, the attacker knows the database is expecting 6 columns.
: This "comments out" the rest of the original SQL query written by the developers.
: The attacker wants the database to return the results of the original query plus the results of their injected query.
This is a SQL operator used to combine the result sets of two or more SELECT statements into a single result set.
This string is a classic example of a used by security researchers and attackers to probe a website's database for vulnerabilities.
: For a UNION to work, the second query must have the exact same number of columns as the first query. 3. SELECT NULL,NULL,NULL,NULL,NULL,NULL
: Any code that was supposed to follow the input (like a closing quote or a WHERE clause) is ignored by the database, preventing syntax errors that would break the injection. 5. GoJB
