: This operator combines the results of the original query with a new, malicious SELECT statement.

: The double dash ( -- ) is a comment in SQL, which "neutralizes" the rest of the original developer's code so it doesn't cause an error. Why This Matters SQL injection UNION attacks | Web Security Academy

: This is a negative number likely used to ensure the original query returns no results, forcing the application to display only the results from the injected UNION statement.

: These are placeholders used to match the number and data type of columns in the original query. The specific string 'qbqvq'||'pBDUArKiBK'||'qqbqq' is a unique marker; if it appears on the webpage, the attacker knows the injection was successful.