The attacker sees this error in the HTTP response. Because the error contains the 1 (the result of the subquery), the attacker knows the injection worked. :
: Configure the web server to show generic error pages instead of raw database error strings to the end user. The attacker sees this error in the HTTP response
The payload attempts to force the database to trigger an error message that contains specific data, which confirms the vulnerability and the database type. : The attacker sees this error in the HTTP response