: The attacker uses a specific number of NULL values to match the number of columns in the original query's SELECT statement. NULL is used because it is compatible with almost any data type (strings, integers, dates), maximizing the chance that the injected query will succeed.
: The number of NULL values (5 in this case) does not match the number of columns in the original table.
: This is a comment indicator that tells the database to ignore the rest of the original query that follows.
The string you provided is a designed to discover the number of columns in a database table. Breakdown of the Payload