T-SQL (string manipulation)

Below is example of using string manipulation function of T-SQL to mask off part of content of a string

SUBSTRING(ui.userid,1,4)+'XXXX'+SUBSTRING(ui.userid,len(ui.userid)-3,4) as userid

userid will become "123XXXX456"