The "?code=sq0cgp-GbpKLfU7fpPZCTxuVt-F8A&response_type=code&state=604fc52b2656c#_=_" part makes sense (and is all generated by Square during the authorization process).
But the index.html part before it shouldn't be there. Instead it should be "https://your_domain.com/square_handler.php", and it should get that from the URL you provide in the OAuth settings in the Square account app.