Member Avatar for DaveyMoyes

Hi all, is it possible to add ?variable=value to the end of a facebook application url ?

for example:
facebook.com/pagename/app_abcdefghij/phppage.php?variable=value

then use a _Get to query a mysql database ?

  • 2 Contributors
  • 3 Replies
  • 105 Views
  • 6 Hours Discussion Span
  • Latest Post Latest Post by <M/>

Dani AI

Generated

Short answer: you can pass data into a Page Tab, but you should not rely on appending arbitrary query strings to the facebook.com/page/... address and expecting them to arrive as normal $_GET values inside the tab iframe. For Page Tabs the supported way to deep‑link is app_data, which Facebook delivers to your app inside the signed_request parameter. This is the mechanism to use for reading state and then querying your database (answering and building on 's question about "why?").

How it works, at a glance:

  • Add an app_data value when linking to the tab (Facebook will carry it for you).
  • When Facebook loads the tab it POSTs a signed_request to your tab URL.
  • Decode and verify signed_request server‑side, then read app_data from the decoded payload and use that value (after sanitizing) in your DB queries.

Minimal PHP example to get app_data from signed_request:

function base64_url_decode($input) {
  return base64_decode(strtr($input, '-_', '+/'));
}

function parse_signed_request($signed_request, $app_secret) {
  list($encoded_sig, $payload) = explode('.', $signed_request, 2);
  $sig = base64_url_decode($encoded_sig);
  $data = json_decode(base64_url_decode($payload), true);

  $expected = hash_hmac('sha256', $payload, $app_secret, true);
  if ($sig !== $expected) return null;
  return $data;
}

$sr = isset($_REQUEST['signed_request']) ? parse_signed_request($_REQUEST['signed_request'], APP_SECRET) : null;
$app_data = isset($sr['app_data']) ? $sr['app_data'] : null;

Notes and cautions: always verify the signed_request signature, validate and sanitize app_data before using it in SQL (use prepared statements / PDO), and handle the case where users visit your app URL directly (outside Facebook) where signed_request may be absent. See Facebook's Page Tabs documentation for the official details: Page Tabs documentation.

Recommended Answers

All 3 Replies

Member Avatar for <M/>

hmmm... I don't do fb app developing but i think it is possible....

Member Avatar for DaveyMoyes

Cheers, I have only seen it on one or two apps, So I know it is possible, just not sure how. . . Hoping someone can point me in the right direction here.

Member Avatar for <M/>

The questions is... why would you need to do that?

Be a part of the DaniWeb community

We're a friendly, industry-focused community of developers, IT pros, digital marketers, and technology enthusiasts meeting, networking, learning, and sharing knowledge.