如何在PHP中获取URL哈希(#)后的参数？以获取access_token为例

Great question! Let's break this down clearly because the hash fragment (#) in URLs has an important quirk: browsers never send anything after the # to the server by default. So how you grab that access_token depends on exactly what you're doing in your PHP workflow:

Scenario 1: You need to get the hash from a user's browser and send it to your PHP backend #

Since the server never sees the hash fragment automatically, you'll first use JavaScript to extract it client-side, then send it to your PHP script. Here's a step-by-step approach:

Step 1: Parse the hash fragment with JavaScript #

Modern browsers make this easy with the URLSearchParams API:

// Slice off the leading #, then parse the hash like a regular query string
const hashParams = new URLSearchParams(window.location.hash.slice(1));
const accessToken = hashParams.get('access_token');

// You now have your token: 1b6e37716abdh
console.log('Access Token:', accessToken);

Step 2: Send the token to your PHP backend #

Use the Fetch API (or XMLHttpRequest for older browsers) to post the token to a PHP endpoint:

fetch('/process-token.php', {
  method: 'POST',
  headers: {
    'Content-Type': 'application/x-www-form-urlencoded',
  },
  body: `access_token=${encodeURIComponent(accessToken)}`
})
.then(response => response.text())
.then(data => {
  console.log('PHP received the token:', data);
  // Optional: Redirect or update the page here
});

Step 3: Receive and use the token in PHP #

In process-token.php, you can grab the token from the POST request:

<?php
if ($_SERVER['REQUEST_METHOD'] === 'POST') {
    // Always sanitize input to avoid XSS risks
    $accessToken = htmlspecialchars($_POST['access_token']);
    
    // Do what you need: store in a database, call an API, etc.
    echo "Successfully received token: " . $accessToken;
} else {
    http_response_code(405); // Method Not Allowed
    echo "Only POST requests are accepted here";
}
?>

Scenario 2: You're working with the full URL string directly in PHP #

If you have the complete URL stored as a string (e.g., from a database, crawler, or log), you can parse it manually in PHP:

<?php
$url = "https://WBSITE_LINK.com/#access_token=1b6e37716abdh&state=state123&scope=profile%20booking&token_type=bearer&expires_in=15552000";

// Split the URL at the # to isolate the hash fragment
$urlParts = explode('#', $url);

if (isset($urlParts[1])) {
    // Parse the hash fragment just like a standard query string
    parse_str($urlParts[1], $hashParameters);
    
    if (isset($hashParameters['access_token'])) {
        $accessToken = htmlspecialchars($hashParameters['access_token']);
        echo "Extracted Access Token: " . $accessToken; // Outputs 1b6e37716abdh
    } else {
        echo "No access_token found in the hash fragment";
    }
} else {
    echo "This URL doesn't have a hash fragment";
}
?>

Key Notes to Remember #

• Sanitize everything: Always use htmlspecialchars() (or appropriate validation) when handling user-provided data to prevent cross-site scripting (XSS) attacks.
• Browser support: URLSearchParams works in all modern browsers, but if you need to support very old ones, you can fall back to manual string splitting (e.g., split('&') and split('=')).
• Hash fragments are client-side only: Never expect PHP to see the hash fragment from a user's request directly—you must send it via JavaScript first.

内容的提问来源于stack exchange，提问作者Jas P