# Redirect to the initial requested URL including Query parameters **URL:** \ **Category:** Get Help\ **Tags:** auth0-php, php\ **Created:** [April 10, 2021, 5:46pm UTC](https://community.auth0.com/t/redirect-to-the-initial-requested-url-including-query-parameters/60876 "2021-04-10T17:46:17Z")\ **Posts on this page:** 4\ **Page:** 1
**Author:** ![irtech](https://sea1.discourse-cdn.com/auth0/user_avatar/community.auth0.com/irtech/32/13532_2.png) [@irtech](https://community.auth0.com/u/irtech)\ **Post date:** [April 10, 2021, 5:46pm UTC](https://community.auth0.com/t/redirect-to-the-initial-requested-url-including-query-parameters/60876/1 "2021-04-10T17:46:17Z")
I implemented the login of the application based on the provided vanilla PHP-SDK Sample which works like this: - User tries to open a page of the application which is only accessible to logged in users, let’s say /home.php?topic=test&revision=12 - Check for `$auth0->getInfo()` - If no user loggedin redirect to a login.php page and send the accessing url along (e.g. redirect\_to=home.php?topic=test etc. (of course encoded) - From there perform the actual login through `auth0->login()` with the `redirect_uri` specified to the query-parameter value of `redirect_to` It usually works like a charm, but while using `sign in with google` after redirection all the `&` chars are encoded to `&%3B` One workaround for this was to check in the url for those `&%3B` and redirect the user to an url where those are actually replaced with `?`. But this seems like a very _hacky_ approach and so I’m wondering if there is a different way of achieving something like that through the SDK alltogether. Is there maybe a specific auth0-concept which I’m missing to achieve that? Or do I have to stick to that hack? ---
**Author:** ![evansims](https://sea1.discourse-cdn.com/auth0/user_avatar/community.auth0.com/evansims/32/27011_2.png) [@evansims](https://community.auth0.com/u/evansims)\ **Post date:** [June 24, 2021, 4:47pm UTC](https://community.auth0.com/t/redirect-to-the-initial-requested-url-including-query-parameters/60876/2 "2021-06-24T16:47:46Z")
Hey @irtech 👋 I’m not sure if we have best practice advice published expressly against using parameters with redirect\_uris, but it’s fraught with potential for issues like this as encoded strings get passed around between endpoints. Better off avoiding using params there. My suggestion would be to set a cookie or PHP session key for the user’s device prior to issuing the login redirect — something you can safely store on your app’s end and pull up when the user returns from the authentication flow to your callback route, etc. Set the value (complete with those request params you want) to where you want to bounce the user to after they’re returned to your app’s callback from the Auth0 flow completing. When they hit your app’s callback, pull that stored key you made, and issue a redirect to that stored value location. Alternatively, if the string doesn’t end up being too long, you could encode a custom ‘state’ that includes that information, so it’s returned to you after the flow as the state param, can then decode it, and use that - but setting something on your app’s end with a cookie or session would be a bit more resilient to issues, I think. This would be more appropriate if you’re writing a stateless app, like an API. There are a few good docs I found that offer guidance on this sort of approach: > **[Redirect Users](https://auth0.com/docs/authenticate/login/redirect-users-after-login)** > > Describes how to redirect users to URLs that have not been added to the AllowList. > **[Prevent Attacks and Redirect Users with OAuth 2.0 State Parameters](https://auth0.com/docs/secure/attack-protection/state-parameters)** > > Describes how to use the state parameter in authentication requests to help prevent CSRF attacks and restore state ---
**Author:** ![konrad.sopala](https://sea1.discourse-cdn.com/auth0/user_avatar/community.auth0.com/konrad.sopala/32/13516_2.png) [@konrad.sopala](https://community.auth0.com/u/konrad.sopala)\ **Post date:** [June 25, 2021, 6:59am UTC](https://community.auth0.com/t/redirect-to-the-initial-requested-url-including-query-parameters/60876/3 "2021-06-25T06:59:44Z")
Thanks @evansims for following up on that! ---
**Author:** ![system](https://global.discourse-cdn.com/auth0/original/3X/b/5/b560f266932fcce5d57f09a6595bd50518cae3f3.jpeg) [@system](https://community.auth0.com/u/system)\ **Post date:** [July 16, 2021, 3:18pm UTC](https://community.auth0.com/t/redirect-to-the-initial-requested-url-including-query-parameters/60876/4 "2021-07-16T15:18:58Z")
This topic was automatically closed 15 days after the last reply. New replies are no longer allowed.