The query ' UNION ALL SELECT NULL-- is a classic payload used in attacks to determine the structure of a database query. It is used when an application is vulnerable to SQL injection and returns query results directly in its HTTP responses.
Comments out the rest of the original SQL query, preventing syntax errors caused by the remaining code. Purpose and Techniques SQL injection UNION attacks | Web Security Academy
Combines the results of the original, intended query with the results of a new, malicious query.