: The attacker is trying to append their own results to your original database query.

If you expect a zip code, don't accept a string that starts with UNION .

: They use "NULL" to figure out exactly how many columns your database table has without triggering a data-type error.

The snippet {KEYWORD} UNION ALL SELECT NULL,NULL,NULL-- is a classic attack pattern.

You don’t have to be a security wizard to stop this. The "Golden Rule" of modern web dev is simple:

Tools like Sequelize, Eloquent, or Entity Framework handle much of this protection for you by default. The Bottom Line