: char(126) is the tilde character ( ~ ). The payload attaches this to the start of the data so that the resulting error message clearly displays the extracted value.
: Attempts to close a single-quoted string literal in the original SQL query.
What is SQL Injection? Tutorial & Examples | Web Security Academy
: Calculates the MD5 hash of a specific number. In security testing, this is used as a "canary"—if the database error message displays the calculated hash, the tester knows the injection was successful.