I would guess that the ' in 'hash=123456' is part of the expression instead of being the quotes as you expect.

For exact match, try:

Require expr %{QUERY_STRING} = hash=123456 

If you could have other parameters than hash, you might need regular expressions:

Require expr %{QUERY_STRING} =~ /hash=123456/ 

However, that would match someparam=foo&anythinghash=12345678, too. A possible fix for that:

Require expr %{QUERY_STRING} =~ /[^&]hash=123456[&$]/ 

I would guess that the ' in 'hash=123456' is part of the expression instead of being the quotes as you expect.

For exact match, try:

Require expr "%{QUERY_STRING} == hash=123456" 

If you could have other parameters than hash, you might need regular expressions:

Require expr "%{QUERY_STRING} =~ /hash=123456/" 

However, that would match someparam=foo&anythinghash=12345678, too. A possible fix for that:

Require expr "%{QUERY_STRING} =~ /(^|&)hash=123456($|&)/"