↑
добавляет окончание ко всем твоим реквестам
http://site/injection.php?param=1+union+select+123-BR
http://site/injection.php?param=1+un...t+@@version-BR
идея понятна?

To pass the validation and successfully exploit this SQLi, we must inject our payload between the numerical value and the "-BR" suffix. This is a typical Blind SQL Injection